iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Where to start? Build a small-business security baseline in this order: secure administrator and email accounts, protect every device with updates and encryption, create recoverable backups, and teach people how to report suspicious activity. This sequence follows U.S. Cybersecurity and Infrastructure Security Agency (CISA) guidance for small organizations. It is practical risk reduction, not a certification or a substitute for professional incident-response help when an attack is serious.
Your exact controls depend on the services you use, the devices your team owns, the sensitivity of your data, and how quickly you must recover. The baseline below separates broadly applicable actions from choices that require a closer look at your own environment.
1. Decide what must be protected first
Start with an inventory rather than buying a security product. List your business email, administrator consoles, cloud file storage, accounting and payment systems, customer databases, developer tools, collaboration platforms, laptops, phones, tablets, removable drives, and any remote-access service. For each item, record who can sign in, what data it contains, whether it supports multifactor authentication (MFA), and how you would recover access if the primary administrator were unavailable.
Rank the accounts that could unlock everything else. A person who controls your email can often reset other passwords; an administrator can create users, change billing, export data, or disable security settings. Those accounts deserve the strongest available authentication and a documented recovery path before ordinary user accounts.
#1 Best Overall
- Tier one: administrator, identity-provider, email, file-storage, domain/DNS, financial, and remote-access accounts.
- Tier two: systems containing customer, employee, source-code, product, or confidential business information.
- Tier three: lower-impact services that do not provide a path into higher tiers.
This inventory also tells you where a generic recommendation does not fit. A company that has no remote access has no remote-access account to harden, while a distributed team may need several such services and a more formal offboarding process.
2. Secure business accounts with MFA and good credentials
Make MFA mandatory at the highest-impact accounts
Require MFA wherever a service supports it, beginning with tier-one accounts. CISA describes MFA as an additional layer beyond a password and recommends prioritizing administrative access, sensitive data, email, file storage, and remote access. Turn it on in the service’s security or sign-in settings, enroll a second method, and test sign-in and recovery while you still have an authenticated session. Store recovery codes in a protected location rather than in an unencrypted note.
Choose the strongest method the specific account supports. CISA’s ordering is useful because it balances resistance to phishing with practical availability:
| MFA method | Security characteristics | Use and limitations |
|---|---|---|
| FIDO security key or other hardware token | Strongest phishing resistance among the methods listed by CISA | Use for administrators and other high-impact accounts when the service and devices support it; keep a separately secured spare and plan recovery if a key is lost. |
| Authenticator app with number matching | Strong protection when the user verifies the number shown during sign-in | Practical for many teams; enrollment and account-recovery procedures still need to be documented. |
| Authenticator-generated one-time code | Better than a password alone, but a code can be captured by a convincing phishing site | Useful when number matching or a security key is unavailable. |
| Biometrics | Convenient and generally tied to a particular device | Best used with another factor; a fingerprint or face scan may not be available on every device or service. |
| SMS or email code | Weakest option in CISA’s listed set because messages can be intercepted or redirected | Use only when stronger methods are unavailable. Eric Goldstein, CISA’s Executive Assistant Director for Cybersecurity, wrote: “While better than having no additional security layer, Short Message Service (SMS) should be an organization’s last resort for implementing multifactor authentication.” |
Goldstein also recommends hardware-based tokens, such as FIDO or Public Key Infrastructure, for the greatest resistance to exploitation. That is MFA advice, not a claim that every service accepts those technologies. Verify compatibility, supported browsers and operating systems, and the account’s recovery process before making a hardware key the only way in.
Use a password manager instead of memory or notes
CISA describes strong passwords as long, random, and unique. A password manager can generate a different credential for every service and store it in an encrypted vault, so you do not have to reuse passwords or keep a plain-text list. Do not infer a universal minimum length from the guidance; the important properties are length, randomness, and uniqueness.
Protect the password manager’s own account with the strongest MFA available. Create separate vault access for each employee, grant only the sharing permissions a role requires, and remove access promptly when someone leaves or changes responsibilities. Decide in advance how the business will regain access if the vault administrator is unavailable. Provider-specific recovery, team administration, security controls, and current pricing vary, so evaluate those features against your company’s needs before selecting a service.
Control access over time
Maintain a short access register showing the owner, backup owner, MFA method, recovery contact, and last review date for each critical account. Use individual accounts instead of shared administrator credentials whenever a service allows it. Review access after hiring, role changes, contractor engagements, and departures. A password change alone is not enough if an old session, API token, recovery email, or active device remains authorized.
3. Harden laptops, phones, and business software
Patch before adding complexity
Keep operating systems, browsers, mobile software, business applications, and network equipment current. Enable automatic updates where they are reliable and compatible with your operations; otherwise assign an owner to review and install updates on a defined cadence. Restart devices when an update requires it instead of postponing indefinitely. Keep a simple record of versions for equipment that cannot update automatically.
Unsupported systems no longer receive the fixes you depend on. Plan replacement before a vendor’s support ends, and isolate a legacy system from sensitive services if an immediate replacement is impossible. CISA’s small-business starter guidance identifies MFA, patch and update management, and data backups as early cyber-readiness actions; they are foundational controls, not optional polish.
Encrypt devices and removable media
Enable the operating system’s full-device encryption on laptops, desktops, and phones that store business information. Encrypt removable drives and relevant documents as well. Encryption reduces exposure if a device or drive is lost, but it does not protect an unlocked device from a malicious user or a compromised account. Store recovery keys securely and ensure an authorized person can retrieve them during a hardware failure or employee absence.
Separate business and personal use where feasible. Require a screen lock, short automatic lock timeout, and current security updates. Avoid installing unapproved software with administrative privileges. When employees work from home or travel, establish where devices may be used, how they should be reported if lost, and which information must not be copied to personal equipment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reduce the damage a stolen session can cause
Sign out of administration consoles when work is complete, review active sessions and connected applications, and revoke tokens that are no longer needed. Limit administrator rights on everyday user accounts so a phishing incident does not automatically grant system-wide control. These settings differ by platform, so document the exact menu path for each critical service in your internal runbook.
4. Protect data and make recovery possible
Choose a backup arrangement you can actually restore
CISA recommends backup copies on an external hard drive or through a properly vetted cloud service. The right medium depends on your data volume, connectivity, retention needs, budget, and who can administer the account. Evaluate each option against five questions:
- Is a copy separated from the device and account that could be compromised?
- Is the copy encrypted in transit and at rest, and who controls the keys?
- Which people or services can delete, overwrite, or download it?
- How quickly can you restore a working file, a whole device, or a critical application?
- How will you reach the backup if your primary identity account is locked?
An external drive is convenient for local copies, but disconnect it when it is not actively backing up. CISA warns that a drive left connected can be reached by ransomware and encrypted along with the computer. A vetted cloud service can provide geographic separation and managed infrastructure, but its access controls, retention behavior, administrator recovery, and provider security deserve scrutiny. No single schedule or product is best for every founder; choose a frequency based on how much recent work you could afford to lose and test that assumption.
Test restoration, not merely backup completion
Perform a small file restore first, then a larger recovery exercise for your most important system. Confirm that files open, permissions are usable, and the person performing the restore has the required credentials. Record the time, steps, and obstacles. Protect recovery codes, encryption keys, and backup-administrator credentials separately from the data they unlock. A backup that exists but cannot be decrypted or reached during an outage is not a dependable recovery plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Map sensitive data
Identify where customer records, employee information, financial documents, source code, intellectual property, and credentials are stored. Remove unnecessary copies and limit downloads to devices that are encrypted and managed. For documents that must be shared, use the storage service’s access controls rather than sending uncontrolled attachments. Encryption lowers the consequences of loss, while access reduction lowers the chance that loss occurs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Make phishing reporting and response routine
Train for recognition and reporting
Teach employees to pause when a message requests an urgent payment, password, MFA approval, gift card, file download, or change to bank details. They should verify unusual requests through a known channel, not by replying to the suspicious message. Include text messages, collaboration chats, voice calls, and fake login pages in training; phishing is not limited to email.
Give everyone one obvious reporting route, such as a dedicated mailbox, help-desk form, or chat channel monitored by a named person. The instruction should say what to send, what not to click, and what to do if a link was already opened or credentials were entered. Thank people for early reports rather than treating a near miss as misconduct. Fast reporting gives you a chance to revoke sessions, reset credentials, warn others, and preserve evidence.
Log enough to investigate
Enable the security and audit logging that your major services provide. At minimum, know how to review sign-ins, MFA changes, password resets, new administrators, mailbox forwarding rules, file-sharing changes, and large downloads. Assign an owner to check alerts and define how long useful logs should remain available. Logging is valuable only if someone can access it during an incident; avoid storing all records under the same administrator account an attacker might disable.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Write a short incident-response plan
Name the person who coordinates an incident, the backup coordinator, the technical contact, the communications decision-maker, and the person responsible for contacting insurers, legal counsel, vendors, or authorities when appropriate. Keep their phone numbers outside the primary email system. Define the first actions for a suspected account takeover: preserve relevant information, isolate an affected device when safe, revoke active sessions, reset credentials from a known-clean device, and notify the people who may be targeted next.
Best Value
- Easy To Track Your Finances: HAUTOCO horizontal accounting ledger book keeps you on top of your expenses and income! Help you keep your money organized, spend well, and set and achieve financial goals
- Practical Design: The accounting book is PU leather hardcover, with double-wire spiral binding that allows it to lay flat 360°; 100gsm thick paper, comes with an elastic band, pen loop, bookmarks, and 2 large pockets for storing loose notes
- Plenty of Space: The expense tracking notebook measures 10.78 x 8'' and has 120 pages with 3000 lines of entries giving you enough space to record each of your transactions
- Manage Your Finances Effectively: Undated accounting books with number, date, description, account, payment or deposit amount, and total balance. You will be able to easily analyze your financial activities and quickly prepare accurate financial statements
- Ideal For Small Business or Personal Use: An accounting log journal can track your business or personal financial status. With a clear record of transactions, you can find unnecessary expenses or fraudulent charges
Set decision points for involving specialist help. A widespread ransomware event, suspected theft of regulated information, destructive administrator activity, or an incident you cannot contain should not be handled as a do-it-yourself exercise. CISA’s small-business resources support logging and incident planning, but those practices do not replace professional response in a serious breach.
6. Turn the baseline into an operating habit
Assign one accountable owner for security coordination even if the work is shared. The owner should maintain the account and device inventory, track unsupported systems, confirm that backups restore, review access changes, and schedule short training refreshers. Each critical control needs a backup person so vacations and departures do not create a single point of failure.
Document procedures where a new employee can follow them without guessing: enrolling MFA, requesting access, reporting a suspicious message, locating recovery material, replacing a lost phone or key, and restoring a file. Keep the document itself protected and avoid placing secrets such as passwords or recovery codes inside it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Review the baseline after a major service, device, office, or staffing change. Reassess which accounts are administrative, whether a new vendor can export data, and whether the backup and incident plan still works. CISA’s recommendations are U.S.-oriented guidance rather than a statement of jurisdiction-specific legal requirements, so obtain local legal or regulatory advice when your industry or customers impose additional obligations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
