iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most useful small-business cybersecurity plan is a prioritized routine: identify the devices, accounts, data and suppliers you depend on; protect access and networks; maintain and back up systems; train people; and rehearse what happens when something goes wrong. You do not need an enterprise security department to begin, but you do need assigned owners, repeatable checks and tested recovery.
This U.S.-oriented checklist follows the six functions in NIST Cybersecurity Framework (CSF) 2.0—Govern, Identify, Protect, Detect, Respond and Recover—while keeping the actions practical for a small team. NIST describes cybersecurity as “a continuous process,” not a one-time purchase.
What a small-business cybersecurity baseline should accomplish
A baseline reduces avoidable exposure and limits the damage of an incident. It should answer six operational questions:
Recommended Free Tools
- Govern: Who owns security decisions, and which legal, contractual or insurance requirements apply?
- Identify: Which devices, services, accounts, data and suppliers does the business rely on?
- Protect: Are access, devices, software, networks, people and backups configured to resist common attacks?
- Detect: How will you notice suspicious logins, malware, lost devices or unusual data activity?
- Respond: Who makes decisions, contains an incident and communicates with staff, customers and authorities?
- Recover: How will operations and data be restored, and what will be improved afterward?
NIST SP 1300 is a small-business quick-start guide for organizations with modest or no formal cybersecurity plan. It supplements the CSF 2.0 rather than replacing it. Use both as organizing tools, then adapt the controls to your industry, locations, contracts and systems.
#1 Best Overall
1. Govern: assign responsibility before you buy tools
Security tasks fail when everyone assumes someone else is handling them. Name a person with authority to make decisions, even if that person is the owner or operations manager. Record who approves new accounts, who can authorize payments, who contacts vendors, who preserves evidence and who speaks to customers during an incident.
Write down the business constraints
- List privacy, payment, health, employment, contractual and professional obligations that apply to your business.
- Record critical operating hours, acceptable downtime and the systems that must be available to keep selling, serving customers or paying staff.
- Note which work is performed by employees, contractors, remote workers and technology suppliers.
- Review whether cyber insurance is appropriate for your risks, exclusions, security requirements and budget. Insurance does not replace prevention or recovery planning.
This is general guidance, not a legal checklist or a security audit. Notification duties and deadlines depend on the data involved, the affected people, your industry, your locations and applicable law. Obtain qualified legal or cybersecurity advice for a complex environment or an active incident.
2. Identify what you have and what matters
You cannot protect an asset you do not know exists. Build one inventory and update it when equipment, software, staff or suppliers change.
Make an asset inventory
- Devices: laptops, desktops, phones, tablets, servers, printers, point-of-sale terminals, cameras, network equipment and removable drives.
- Software and services: operating systems, accounting, payroll, email, file sharing, customer databases, websites, payment services and line-of-business applications.
- Accounts: administrator, employee, contractor, service, emergency and shared accounts. Record the owner, purpose, authentication method and last review date.
- Data: customer and employee records, payment information, intellectual property, credentials, tax records, contracts and backups. Note where each type is stored and who needs it.
- Connections: internet links, remote-access tools, integrations, application programming interfaces and vendor connections.
For each item, record a business owner, technical owner, location, importance, supported version and replacement or retirement plan. Mark systems that can stop operations, expose personal information or provide administrative access. Those deserve earlier protection and more frequent review.
Rank #2
Review third parties before granting access
Ask what a supplier can access, why it needs that access, how it authenticates, how it protects and deletes your data, and how it reports incidents. Give each vendor the minimum permissions required, limit access to the time window needed, disable dormant accounts and require a named contact for security events.
3. Protect accounts and identities
Stolen credentials are often the shortest path into a small business. Apply the same standard to cloud services, email, social accounts, remote access, point-of-sale administration and financial systems.
Password rules that staff can follow
- Require a unique password for every important account; never reuse a password from personal services.
- Use passwords of at least 12 characters, as described by the Federal Trade Commission (FTC), and prefer long passphrases that are difficult to guess.
- Use a password manager to create and store unique credentials if it fits your accounts and operating systems.
- Change default manufacturer and administrator passwords before a device or service is put into use.
- Limit unsuccessful login attempts and investigate repeated failures rather than allowing unlimited guessing.
- Do not share administrator credentials. Create individual accounts so actions can be attributed and access can be removed when a role changes.
Require multifactor authentication
Enable MFA wherever an account supports it, prioritizing administrators, email, finance, payroll, customer data and remote access. MFA combines a password with another proof, such as an authenticator code or a hardware security token. Phishing-resistant MFA is preferable when available because it is designed to resist fake sign-in pages that steal one-time codes.
| MFA method | Strengths | Questions to resolve |
|---|---|---|
| Authenticator application code | Usually quick to deploy and does not require a dedicated token. | Does the account support it? What happens if the employee loses or replaces the phone? Are backup codes stored securely? |
| Hardware security key | Can provide strong, phishing-resistant authentication and works without cellular service. | Is the key compatible with every account, browser, operating system and device? Keep a controlled spare and document replacement procedures. |
| Text message code | Available on many older services and easy for staff to understand. | It is generally less resistant to number-porting and phishing than stronger methods. Use a better option when the account supports one. |
Test enrollment, recovery and account-lockout procedures before making MFA mandatory. Keep recovery codes under the same protection as passwords, and ensure at least two authorized people can recover a business-critical account without creating a permanent shared login.
4. Maintain devices and software
Turn on automatic updates where appropriate and install security patches promptly. Supported operating systems and applications receive fixes; unsupported versions become an accumulating risk. Keep maintained security software enabled, and configure it to update its detection data.
- Encrypt laptops, phones and removable media that contain sensitive information. Store recovery keys where an authorized administrator can retrieve them without exposing them to ordinary users.
- Use screen locks, short idle timeouts and remote-wipe capability where the platform supports it.
- Remove software and accounts that are no longer needed.
- Restrict installation and administrative rights to people who need them for their jobs.
- Change default passwords on routers, printers, cameras, point-of-sale equipment and other connected devices.
- Record exceptions when an old device cannot be patched, and isolate or replace it on a defined schedule.
5. Secure the business network
Start with the router or firewall supplied by your internet provider or installed by your IT support. Change its administrator credentials, disable remote management from the internet unless there is a documented need, and keep its firmware current.
Wireless configuration checklist
- Use WPA2 or WPA3 encryption, selecting the strongest mode supported by all managed devices.
- Set a long, unique Wi-Fi passphrase and change it when someone who knew it leaves or when compromise is suspected.
- Create a guest or public network separate from the business network. Do not let visitors or personal devices reach point-of-sale, file or administrative systems.
- Restrict the business network to managed devices and review connected-device lists for anything unfamiliar.
- Separate sensitive systems where practical, such as payment terminals, office workstations, building controls and guest access.
Remote access should use MFA, named accounts and logging. Avoid exposing administrative interfaces directly to the public internet.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Prepare people to spot and report attacks
Technical controls cannot reliably stop a convincing payment request or a malicious attachment. Give staff short, recurring training tied to the work they actually do.
Rank #4
Teach the warning signs
- Unexpected links, attachments, login prompts or urgent requests to bypass normal approval.
- Messages that change a supplier’s bank details, request gift cards or ask for confidential information.
- Domain names, sender addresses, tone or payment instructions that do not match the usual pattern.
- Unusual MFA prompts, antivirus warnings, disabled security tools or files that suddenly become unreadable.
Provide one obvious reporting route, such as a monitored address or phone extension. Tell employees not to delete suspicious messages before the responsible person preserves them. For payment or account-change requests, verify through a trusted contact method already on file—not by replying to the message.
Include lost-device instructions: report the loss immediately, do not attempt to recover a device from a risky location, and allow an administrator to lock, wipe or revoke sessions.
7. Back up data and test restoration
A backup is useful only when the business can restore the data it needs. Back up important files and system data routinely to an appropriate cloud or external-drive destination. Protect the backup account with MFA and encryption, keep at least one copy offline or otherwise isolated from the business network, and test restoration on a schedule.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Approach | Recovery speed and data loss | Isolation and protection | Testing and fit |
|---|---|---|---|
| Cloud backup or managed backup service | Often supports frequent backups and faster recovery over a reliable connection; actual recovery time depends on the service and internet capacity. | Isolation, encryption and retention vary by configuration. Use a separate administrator and verify that ransomware cannot overwrite every backup. | Request a test restore of representative files and, when possible, a full system. Confirm it covers your applications and data locations. |
| External drive rotation | Can restore quickly for local files, but the interval between drive rotations determines how much recent work could be lost. | Disconnect and store a current drive offline when it is not being updated. Encrypt it and protect it against theft, fire and unauthorized access. | Label drives, track rotation, and perform restoration tests on a schedule. One permanently connected drive is not an offline backup. |
| Combined plan | Uses frequent operational copies plus a separate recovery copy for larger outages or ransomware. | Combines cloud or local convenience with an isolated copy, provided credentials and retention are managed separately. | Best when the business has several systems, but document ownership, order of restoration and dependencies. |
Define which files and systems are essential, how recent a restored copy must be, and the order in which services return. Test a single file, a folder, a user account and a complete critical workflow. Record failures and correct them; do not treat a successful backup job message as proof that recovery works.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Detect problems early
Enable security alerts and review them often enough to matter. At minimum, monitor administrator sign-ins, new MFA enrollments, password resets, impossible travel or unusual locations, malware detections, disabled security software, new forwarding rules and unexpected vendor access.
Keep logs for a period that supports investigation and your contractual or legal obligations. Make sure the clock is correct on important systems so events can be correlated. A small business may use built-in alerts from its email, identity, endpoint, router and backup services; the important point is that someone owns the review and knows what action an alert triggers.
9. Respond to an incident without making it worse
Write a one-page incident plan and keep a copy available when normal systems are unavailable. Include internal and external contacts, decision authority, critical systems, backup locations, insurer requirements, legal counsel and communication templates.
Immediate response sequence
- Report and assess: Record what was observed, when it began, which account or device is involved and who is affected.
- Contain safely: If a device appears infected, disconnect it from the network without powering it down. Do not destroy files or wipe the system before qualified investigators advise you.
- Protect accounts: From a known-clean device, revoke sessions, reset exposed credentials, disable suspicious accounts and review MFA changes.
- Preserve information: Keep relevant messages, logs, alerts, access records and notes. Write down actions and times.
- Investigate scope: Determine which systems and data were accessed, changed, copied or encrypted. Engage experienced internal staff or a third-party cybersecurity company when the situation exceeds your capability.
- Notify appropriately: Contact relevant authorities, insurers, suppliers and affected people when required. Whether notification is required, whom to notify and when depends on the facts and applicable law.
- Recover and improve: Restore from a known-good backup, patch the entry point, strengthen controls and document lessons before returning systems to normal.
Do not promise customers that no data was exposed until the investigation supports that conclusion. Keep communications factual, coordinated and consistent with legal advice.
10. Control vendor and remote access
Supplier access should be specific, time-limited and auditable. Require MFA for remote vendor access, use individual named accounts, approve access windows, and remove access when work ends. Put security expectations in contracts, including incident reporting, data handling, subcontractor responsibilities, secure disposal and cooperation with investigation.
Review integrations and shared credentials at least quarterly. If a supplier cannot meet a required control, document the business decision, compensating measures and an exit or remediation plan.
11. Turn the checklist into a repeatable cycle
Use a simple cadence rather than waiting for an annual review.
Quick Recap
- Every day or week: Review critical alerts, backup results and unusual login reports; act on failed jobs.
- Monthly: Install outstanding patches, review new and departing users, test a small restore and discuss a recent phishing example.
- Quarterly: Review vendors, administrator access, Wi-Fi and router settings, MFA recovery, asset inventory and incident contacts.
- After a change: Update the inventory and risk assessment when you add a service, move offices, change payment systems, acquire a business or permit a new remote connection.
- After an incident or exercise: Record what failed, assign owners and deadlines, and verify the fix.
A practical 30-day starting plan
- Days 1–5: Name the security owner; inventory devices, software, accounts, data and vendors; identify the three systems whose loss would stop the business.
- Days 6–10: Turn on MFA for email, administrators, finance, payroll and remote access; replace reused and default passwords; remove stale accounts.
- Days 11–15: Enable updates and maintained security software; encrypt sensitive devices; change router credentials; disable unnecessary remote administration; separate guest Wi-Fi.
- Days 16–20: Confirm routine backups, create an offline or isolated copy, protect backup administration and perform a restore test.
- Days 21–25: Train staff, publish the reporting route and establish trusted verification for payment and account-change requests.
- Days 26–30: Write and exercise the incident plan, review vendor access and record remaining risks with owners and due dates.
Common mistakes that undermine a good baseline
- Buying security software while leaving email, router or administrator accounts without MFA.
- Keeping one shared administrator password that cannot be traced or revoked.
- Assuming a synchronized folder is an isolated backup when ransomware can encrypt every copy.
- Turning on backups but never restoring a file or testing the order of system recovery.
- Training staff once and then providing no reporting channel or follow-up.
- Allowing vendors permanent, broad access because removing it feels inconvenient.
- Disconnecting an infected computer by shutting it down immediately, which can destroy useful volatile evidence.
- Treating completion of a checklist as proof that every incident is prevented. Controls reduce risk; they do not eliminate it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
