iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Small businesses can make meaningful cybersecurity improvements without hiring a full-time security team. Start by identifying important devices, accounts, software, services, and data; then protect high-impact accounts with multifactor authentication, keep systems updated, maintain isolated backups, train staff, and prepare a response plan. The key is to assign an owner to each task and make security a routine business process rather than a one-time project.
What should a small business do first for cybersecurity?
Begin with an inventory of what the business uses and what it needs to keep operating. You cannot prioritize protection or recovery if you do not know which devices, accounts, services, and information exist. NIST’s Cybersecurity Framework 2.0 Small Business Quick-Start Guide (SP 1300, published February 2024) is designed for organizations with modest or no cybersecurity plans.
Build a practical inventory
Include company laptops and phones, routers, point-of-sale systems, cloud services, business software, email, file storage, payroll and banking accounts, sensitive data, and connections provided by vendors or other third parties. Record who uses each item, who administers it, and how the business would be affected if it were unavailable or accessed by someone unauthorized.
The inventory does not need to begin as a specialized database. A controlled spreadsheet or document is useful if someone is responsible for keeping it current and access is limited appropriately. Include enough detail to distinguish, for example, a staff member’s work laptop from the router that connects the entire office, or a general shared folder from a service holding sensitive customer information.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank risk and name an owner
Prioritize systems based on the damage their compromise or loss could cause: inability to serve customers, interruption of payments, exposure of sensitive information, or loss of access to important business records. For each priority, name a person responsible for the next action. A small business may have one person coordinating security, but responsibility for tasks can still be distributed among the owner, an office manager, an IT provider, and service administrators.
Keep the list tied to decisions. If a critical service is unsupported, has no clear administrator, or cannot be restored from a backup, record the issue and assign a next step. NIST describes cybersecurity as a continuous process; an inventory is useful when it informs ongoing decisions, not just when it is first created.
Which accounts should get multifactor authentication first?
Enable multifactor authentication (MFA) wherever the service offers it, beginning with administrator accounts, email, remote access, cloud storage, payroll, banking, and accounts used by people who handle sensitive data. Where available and compatible, prefer a phishing-resistant method such as a FIDO2 security key.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMFA requires more than a password to sign in, so a stolen or guessed password alone is less likely to be enough to access an account. CISA cautions that strong passwords by themselves are no longer sufficient and recommends phishing-resistant MFA. A security key is not automatically a fit for every account: check that the service and each user’s sign-in setup support the method, and make sure the business has a workable account-recovery process.
Protect high-impact identities, not just the owner’s account
Start with accounts that can reset other accounts, administer devices or cloud services, reach business email, or move money. An attacker who can access a mailbox or administrator account may have a different level of influence than one who can reach a single low-impact account. Apply MFA to staff accounts as well when they can reach important records or services.
Remove shared accounts where practical, disable accounts for former users, and give each person only the access needed for the job. Individual accounts make it easier to control access when a role changes or someone leaves. Avoid treating MFA as a substitute for account hygiene: it does not eliminate the need to remove unnecessary access or protect account recovery.
How can a small business reduce common software and device risks?
Use unique, strong passwords; manage them with a reputable password manager; keep operating systems and applications updated; run current security software; and encrypt devices and sensitive data. These measures reduce avoidable weaknesses, but they need owners and routine follow-through.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make passwords manageable
Use a different password for each service rather than reusing one across business accounts. A password manager can generate and store unique passwords and support controlled sharing when a team needs access to a shared business credential. Choose a tool that allows the business to administer access as staff roles change. Do not leave passwords in an unprotected document or pass them around informally.
NIST recommends considering a password manager and keeping software updated. A manager is useful only if employees use it consistently and the organization knows how access will be handled if an administrator leaves or cannot sign in. Decide who administers the account and how authorized users recover access.
Patch supported systems and replace unsupported software
Enable automatic updates for operating systems, browsers, business applications, routers, and security tools where available. Updates address software that is no longer current; leaving them for an occasional manual cleanup makes it easier for devices and services to drift out of date. If a product is unsupported, patching may no longer be an option, so plan to replace it or move to a supported alternative.
Include devices that are easy to overlook, such as office routers and point-of-sale equipment. Establish who checks that updates have applied, rather than assuming an automatic setting is working everywhere. For devices that cannot be updated automatically, assign a person to review their status and arrange updates or replacement.
Recommended Free Tools
Encrypt business devices and information
Encrypt laptops, phones, removable media, and backups, as well as sensitive data sent outside the company. Encryption helps protect information if a device or storage medium is lost or exposed. Include the relevant devices and data in the inventory so the business can identify where encryption needs to be enabled and who can manage recovery.
How should a small business secure its Wi-Fi and business email?
Use WPA2 or WPA3 Wi-Fi, change the router’s administration credentials, disable remote management unless it is required, and separate guest Wi-Fi from the business network. For business email, configure SPF, DKIM, and DMARC where the email host supports them, and create a callback rule for payment or bank-detail changes.
Reduce exposure through the router and network
Change default router passwords rather than leaving the administration account at its original setting. Remote management should be disabled unless there is a business need for it; if it must remain enabled, make sure someone is responsible for its access and configuration. Give visitors a guest network separate from the one used for business devices. This provides a clearer boundary between guest connectivity and the systems staff use for work.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make high-risk email requests verifiable
SPF, DKIM, and DMARC are email-authentication measures that a business can configure when its email host supports them. They should be part of the business’s email setup, not treated as a replacement for staff judgment. Train employees to be alert to suspicious messages and requests that could redirect a payment.
Free tools Windows power users keep installed
One-click scans. No signup required.
For payments and changes to bank details, verify the request through a known contact method, such as a callback to a number already on file. Do not rely on contact details supplied in the message requesting the change. A clear rule gives employees permission to pause a transaction until the request is checked.
How can a small business prepare for ransomware and data loss?
Back up important files and system configurations regularly or continuously, keep at least one copy offline or otherwise isolated from the production network, and test that the business can restore from it. A backup that has never been tested should not be assumed to be a usable recovery plan.
CISA recommends continuously backing up critical data and configurations with an air-gapped copy. The Federal Trade Commission also recommends backups that are not connected to the network as part of resilience against phishing and ransomware. The practical goal is to maintain a copy that is not exposed in the same way as day-to-day systems.
Choose what must be recoverable
Use the inventory to identify information and configurations the business needs to resume work. That may include essential customer or business records, files needed by staff, and configurations needed to restore important systems. The required recovery set depends on how the business operates; do not assume that copying a few user folders covers the systems on which those files depend.
Test restoration, not just backup status
Check that the business can retrieve files from its backup and restore the information or configurations it expects to need. Assign someone to carry out the test and record what was restored, what did not work, and what needs to change. Testing also helps reveal whether the backup process covers the right information and whether authorized staff can reach the recovery copy when needed.
Set a backup and restoration approach that reflects business needs, and make sure at least one copy is isolated from the production network. No specific backup interval or recovery time applies to every business; the schedule should reflect how much recent work the business can afford to lose and how quickly it needs critical operations back.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should employees know about phishing and suspicious requests?
Train staff to recognize suspicious messages, unexpected payment requests, and requests to change bank details; to report concerns promptly; and to report lost devices. Give employees a clear reporting route and a verification process for high-risk requests. Training is more useful when it tells people what action to take, not just what to avoid.
Employees should know whom to contact if a message looks suspicious, if a device goes missing, or if they think they have shared information with the wrong person. Make reporting straightforward and ensure staff can reach the responsible person without relying on the potentially affected device or account. A prompt report gives the business a chance to assess the issue and take appropriate action.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Refresh training regularly. Controlled phishing simulations may be appropriate for some businesses, but they should support learning and clear reporting habits rather than replace them. CISA and the FTC both frame protections as relevant to organizations of different sizes; the FTC notes that cybercriminals target companies of all sizes.
What should a small-business incident response plan include?
Prepare incident-response, disaster-recovery, and business-continuity procedures before an incident. The plan should identify who isolates affected systems, who contacts legal counsel or authorities, who communicates with customers, and who coordinates restoration of operations.
Write down decisions and contacts
Document who has authority to make key decisions and how to reach them. Include the people responsible for technical response, business operations, legal advice, and customer communications as appropriate for the company. If an outside IT or security provider has a role, state what the provider is expected to do and how staff escalate an urgent issue.
Separate the response to a security incident from the work of restoring normal operations. The business may need to isolate a system while it assesses what happened, then use its recovery procedures to resume work. Record the sequence and contact route so staff do not have to invent them under pressure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rehearse the plan
Rehearse how to contact the right people and restore operations. A tabletop discussion can walk through who responds to a suspicious account login, a lost device, or unavailable business files without requiring a real incident. Use the exercise to identify missing contact information, unclear authority, and recovery steps that staff cannot carry out.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
When should a small business hire an MSP or MSSP?
A small business does not need to hire a managed provider simply because it lacks a dedicated security team. Outside support becomes useful when maintaining updates, monitoring unusual activity, or responding to alerts exceeds the business’s capacity. If continuous monitoring is needed, define the provider’s escalation and response duties clearly.
An MSP generally provides managed IT services; an MSSP focuses on managed security services. The labels alone do not establish what a particular contract includes. Ask what the provider will monitor, during which hours, how quickly it will escalate an alert, and what actions it is authorized to take. Confirm whether the provider handles response or only notifies the business.
Compare providers on scope, access, and recovery
Evaluate the service against the actual gaps identified in the inventory. Useful comparison questions include:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Which MFA methods are supported, and do they include phishing-resistant options compatible with the business’s identity provider and devices?
- How are accounts administered, recovered, and removed when a user or provider relationship changes?
- Which operating systems, applications, routers, and security tools are covered by automatic patching or update management?
- Are backup copies isolated, and who tests restoration?
- What are the monitoring hours, escalation path, and response-time commitments?
- How does the provider handle business data, how long is it retained, and what access controls apply to vendor staff?
- What are the contract scope, exit terms, insurance requirements, and total cost per user or device?
Do not assume that a provider’s presence transfers all responsibility away from the business. The company still needs to know who owns decisions, how to contact the provider, and who communicates with staff and customers if an incident affects operations.
What is a realistic implementation schedule?
Put the highest-impact account and visibility work first, then address common technical weaknesses, and maintain recovery and response routines on an ongoing basis. The sequence below turns the measures into a manageable starting plan; assign each task to a named person and track unfinished work.
First week: establish visibility and protect accounts
- List laptops, phones, routers, cloud services, software, point-of-sale systems, sensitive data, and third-party connections.
- Enable MFA for email, administrator, remote-access, cloud-storage, payroll, banking, and other high-impact accounts; use phishing-resistant MFA where available.
- Remove shared accounts where practical, disable accounts for former users, change default passwords, and limit access to what each person needs for the job.
First month: close common gaps
- Enable automatic updates for operating systems, browsers, applications, routers, and security tools; plan to patch unsupported software or replace it.
- Adopt a reputable password manager for unique passwords and controlled sharing.
- Enable encryption for laptops, phones, removable media, backups, and sensitive data sent outside the company.
- Configure WPA2 or WPA3 Wi-Fi, change router administration credentials, disable remote management unless required, and separate guest Wi-Fi from business use.
- Configure SPF, DKIM, and DMARC where supported by the email host, and establish a callback rule for payment or bank-detail changes.
Ongoing: maintain resilience and response
- Back up files and system configurations regularly or continuously, keep an offline or air-gapped copy, and test restoration.
- Refresh staff training, including how to report suspicious messages and lost devices; consider controlled phishing simulations if appropriate.
- Monitor unusual logins, unauthorized connections, and endpoint alerts. If staff cannot provide continuous monitoring, define the escalation and response duties of an MSP or MSSP.
- Maintain and rehearse incident-response, disaster-recovery, and business-continuity procedures, including contact and restoration steps.
Security does not depend on buying a particular product or completing one checklist once. The useful measure is whether the business can identify its critical systems, control who can reach them, maintain protections, and make informed decisions about response and recovery.
Frequently Asked Questions
What is phishing-resistant MFA, and do all small businesses need a security key?
Phishing-resistant MFA is a stronger sign-in approach than relying on a password alone; CISA recommends using it where available. A FIDO2 security key is one option, but check that the account service and user devices support it before standardizing on keys.
How often should a small business test its backups?
The official guidance cited here recommends testing restoration but does not prescribe one interval for every company. Choose a cadence based on how quickly critical operations need to return and how much recent work the business could tolerate losing.
Does hiring an IT provider make the business’s incident plan unnecessary?
No. A provider can have defined monitoring and response duties, but the business still needs to assign decision authority, identify who communicates with customers, and know how to reach the provider. Put those responsibilities and escalation routes in writing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
