Small Business Cybersecurity: The Ten Steps That Matter Most

What attackers actually do to small businesses

The common attacks are phishing emails, stolen passwords, ransomware and fake invoice or payment-change requests.

Most small business incidents are not sophisticated hacks. They are ordinary tricks:

• Phishing. An email or text that looks real and asks for a password or a click.
• Credential stuffing. Attackers try passwords leaked from other sites on your accounts.
• Ransomware. Malware that locks files until you pay.
• Business email compromise. A fake message that appears to come from a vendor or the owner, asking to change bank details or send a payment.
• Lost devices. A phone or laptop with unprotected data.

Knowing the patterns tells you where to put your effort. The steps below map directly to them.

Steps 1 to 3: accounts and passwords

Turn on multi-factor authentication, use a password manager with unique passwords and remove access when people leave.

1. Multi-factor authentication (MFA). Turn it on for email, banking, accounting, payment processors, cloud storage and social accounts. An authenticator app or hardware key is stronger than text messages. If one thing gets done this week, make it this.
2. Password manager. Each account gets a long, unique password. Nobody should reuse passwords or keep them on sticky notes or in shared spreadsheets.
3. Access control. Give staff the minimum access they need. Remove accounts the day someone leaves. Keep a list of who has access to what.

Limit the number of people who can move money or change bank details. Set the bank to require a second approver for new payees or large transfers.

Steps 4 to 6: devices, updates and backups

Keep software updated, protect devices with encryption and security tools, and keep tested backups that are separate from your main systems.

4. Updates. Turn on automatic updates for operating systems, browsers, routers and business software. Many attacks exploit flaws that have fixes available.
5. Device protection. Use screen locks, full-disk encryption and reputable endpoint security. Enable remote wipe for phones and laptops.
6. Backups. Follow a simple rule: three copies, on two kinds of storage, with one stored offsite or in the cloud and disconnected from your network. Test a restore every quarter. A backup you have never restored is a hope, not a plan.

Backups are your best defense against ransomware, because you can recover without paying.

Steps 7 and 8: train people and verify payment requests

Teach staff to spot phishing and set a rule: any change to bank details or any unusual payment request is confirmed by a call to a known number.

People are the usual way in, so training pays off. Hold a short session twice a year and share examples of real phishing attempts. Teach staff to check the sender address, hover over links before clicking, and be suspicious of urgency or secrecy.

Create a verification rule for money:

• Never change vendor bank details based only on an email.
• Call the vendor at a number you already have on file.
• Require two people to approve payments above a set amount.

Business email compromise often succeeds simply because nobody picks up the phone. A two-minute call is the cheapest control you have.

Steps 9 and 10: network security and a response plan

Secure the Wi-Fi, separate guest access and write a one-page plan for who to call and what to do when something goes wrong.

9. Network. Change default router passwords, use strong Wi-Fi encryption, keep a separate guest network, and turn on the firewall. For payment terminals, follow your processor's security requirements.
10. Response plan. One page that lists: who is in charge, how to isolate affected devices, who to call (IT help, bank, insurer, attorney), how to preserve evidence and how to notify customers if required. Print it and keep a copy offline.

Many states have breach notification laws that apply when customer personal data is exposed. Ask your attorney which apply to you. The FTC and CISA publish free small business guides that are worth reading. Check their current materials for updated advice.

Insurance, costs and what to prioritize

Consider cyber insurance after the basics are in place. Begin with the steps that cost little and block the most common attacks.

Cyber insurance can cover response costs, data recovery and some liability, but policies differ in what they cover and often require basic controls such as MFA and backups. Ask your agent for quotes and read the exclusions.

Priorities if budget is tight: MFA, password manager, backups, updates, payment verification rule, training. These cost little in money and mostly take attention. Specialist help may be worth paying for if you handle sensitive data such as health or financial records, or if you accept payments directly. Those areas have additional rules.

Paying for security and recovering from loss

Security spending is a cost of doing business. If a loss does hit, cash reserves and access to capital shorten recovery.

Budget a small, regular amount for security tools and training, the same way you budget insurance. Add it to your business budget. Illustratively, a 10-person firm might spend a few hundred dollars a month on a password manager, endpoint protection and backups. One avoided incident can be worth many times that.

If a cyber incident or a necessary upgrade creates a sudden cash need, working capital can help with replacement equipment, recovery work or lost sales while you recover. Eligibility at ROI Funder starts at 500+ FICO, 6+ months in business and $20,000+ monthly revenue. Building a reserve first is better. See building a cash reserve.