Most small business owners I talk to think cybersecurity is something you buy. It isn’t. In nearly every incident I have been pulled into over the last decade, the problem wasn’t a missing expensive tool. It was one reused password, or a backup nobody had ever tested that turned out to be three months stale.
So here is the checklist I actually hand people when they ask. No enterprise budget, no dedicated IT person. Just the things that stop the overwhelming majority of what realistically comes at a 5–50 person business.
Fix the accounts before you buy any software
Credentials are the front door. Not zero-days, not sophisticated attackers. It is someone’s password from a 2019 breach still working on your email in 2026.
- Turn on 2FA everywhere, starting with email. Then your domain registrar, then banking, then your website admin. Email goes first because email resets everything else. If someone owns your inbox, they own every account attached to it.
- Use an authenticator app, not SMS, where you have the choice. SIM swap attacks are cheap and real. Setting up a TOTP app takes about 30 seconds per account.
- Put a password manager on the company card. Bitwarden, 1Password, whichever. The brand matters far less than everyone finally stopping the reuse of Company@2024 across nine services. Roughly $3–8 per user per month. That is the highest-return security spend available to a small business, full stop.
- Remove ex-employees the same week they leave, not the same quarter. Write the offboarding list once — email, VPN, WordPress, hosting, Slack, shared drives, any SaaS billing login, and reuse it every time. Fifteen minutes of work.
- Kill the shared admin login. If four people use one account, you have no audit trail, and you cannot revoke access for one person without disrupting three others. Individual accounts with roles, always.
Assume email is where you will get hit
Almost every small business incident I have seen started in an inbox. Not a dramatic hack — an invoice.
The pattern is boring and effective. An attacker sits in a compromised mailbox for a few weeks, reads a real thread between you and a supplier, then sends a follow-up from a lookalike domain saying the bank details have changed. The invoice amount is correct. The project name is correct. The signature is correct. Only the IBAN is different, and finance pays it because everything else checks out.
Three controls that actually stop this:
- A hard rule that bank detail changes are verified by phone, on a number you already had on file, never a number from the email itself. No exceptions for urgency. Urgency is the attack.
- SPF, DKIM and DMARC on your own domain. This does not protect you from receiving fakes, but it stops attackers from spoofing your domain to your clients, which is how a small breach becomes a reputational one. Your email provider or email provider can usually configure it in under an hour.
- An external-sender banner. Most business email platforms can tag messages from outside your domain with a visible warning. It is a two-minute setting that quietly catches a lot.
Also: buy the two or three most obvious typo variants of your domain if they are cheap. Ten dollars a year to remove the easiest impersonation route is a reasonable trade.
A backup you have never restored is not a backup
This is the one that catches everybody. People buy the backup plugin, see the green checkmark in the dashboard, and consider the problem solved. Then the day comes and the archive is corrupt, or it only contains the database and not the uploads folder, or it lives on the same server that just got encrypted.
The minimum standard worth having:
- One copy off the machine that made it. If ransomware hits the laptop or the server, anything mounted to it goes too. Cloud storage that syncs bidirectionally is not a backup either — it will happily sync the encrypted versions over your good files.
- One copy the running system cannot delete. Object storage with versioning or immutability, or an offline drive that gets rotated. Modern ransomware hunts for backups first.
- A restore test every quarter. Put it in the calendar as a recurring event. Restore to a staging site, open it, click around, confirm the last month of data is genuinely there. The first time you do this you will find something broken. That is the entire point of doing it before you need it.
Write down how long a full restore took. If it took six hours, that is your real recovery time — now you can decide whether six hours of downtime is acceptable, instead of discovering the answer during the outage.
Patch the boring things on a schedule
The vulnerabilities that get small businesses are rarely exotic. It is a WordPress plugin that hasn’t been updated since 2022, a router still running its factory admin password, a laptop three OS versions behind.
Pick one hour a month. Same day every month. Work through:
- The website. Core, plugins, themes. Delete anything deactivated : an inactive plugin with a vulnerability is still a file on your server. If you run WordPress, enable automatic updates for minor core releases and for plugins you trust, and reserve the manual hour for the ones that can break a layout.
- Every laptop and phone that touches company data. OS updates on, disk encryption on (BitLocker or FileVault, both free, both already installed), screen lock at five minutes.
- The network hardware nobody remembers owning. The office router, the NAS in the cupboard, the camera recorder. Default password changed, firmware current, admin panel not reachable from the internet.
- Your SaaS permissions. Once a year, open the connected-apps list on your Google or Microsoft account and revoke everything you no longer recognise. That trial tool from 2023 may still hold read access to your entire drive.
Decide who does what before something happens
The gap between a bad day and a catastrophic one is usually preparation, not technology. When a laptop goes missing or the site starts serving spam, the panic costs more than the incident.
One page is enough. On it:
- Who to call first, with mobile numbers — your host, your developer, and your accountant if money is involved.
- Where the backups live and who has the credentials to restore them.
- The account list, in order of what to lock down first.
- Your regulator or breach-notification obligations, if you hold customer data, and the deadline attached.
Print it. Keep a copy outside the systems it describes, because a document stored only on the encrypted server is not much use the day the server is encrypted.
The version of this you can finish in 30 days
Nobody does a fifteen-item list in one sitting. So sequence it:
- Week 1: 2FA on email, domain registrar, banking and website admin. Password manager purchased and rolled out.
- Week 2: Verify your backup by actually restoring it somewhere. Confirm one copy is off-server and cannot be deleted by the live system.
- Week 3: The phone-verification rule for payment changes, written down and shared with anyone who touches invoices. SPF, DKIM and DMARC configured.
- Week 4: Update everything. Write the one-page incident sheet. Book the recurring monthly patch hour and the quarterly restore test in the calendar.
That is four hours of work spread across a month, and maybe $30 a month ongoing. It will not make you unbreachable. Nothing does. But it moves you out of the group that gets hit by automated, opportunistic attacks, which is where the overwhelming majority of small business incidents come from.
The businesses that recover well are never the ones with the best tooling. They are the ones who had tested the restore.
