Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Most small businesses can materially reduce cyber risk by implementing seven fundamentals: inventory what they own and must protect, require strong multi-factor authentication, patch systems, maintain isolated backups, train staff against phishing, secure networks and sensitive data, and prepare to detect, respond to, and recover from incidents. This is an editorial synthesis of Federal Trade Commission (FTC) and Cybersecurity and Infrastructure Security Agency (CISA) guidance, not an official ranking. Your order of work should reflect your systems, data, industry, contracts, insurance terms, and applicable law.
What are the seven cybersecurity practices a small business should have?
The seven practices below map to the functions in NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. The FTC describes that framework as free, voluntary, and flexible. It can organize a program even when a company has no dedicated security department.
- Know your assets, data, owners, and obligations.
- Protect accounts with multi-factor authentication (MFA) and limited access.
- Patch and maintain devices and software.
- Back up data and plan how to restore it.
- Train staff to recognize and report phishing.
- Secure networks and sensitive data.
- Monitor, respond, and recover when something goes wrong.
These controls reinforce one another. An asset inventory shows which accounts and devices need MFA and patches; backups reduce the damage from ransomware; training and monitoring help detect a stolen credential; and an incident plan turns a chaotic event into a series of assigned decisions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How do I identify my business’s assets, data, and obligations?
Start with a written inventory and assign a person accountable for keeping it current. You cannot protect a laptop, cloud service, or customer record that nobody knows exists.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Build an inventory that is useful during an incident
- Devices: laptops, desktops, phones, tablets, servers, network appliances, point-of-sale equipment, printers, and internet-of-things devices.
- Software and services: operating systems, browsers, line-of-business applications, email, file storage, payroll, accounting, payment, remote-access, and collaboration systems.
- Data: customer and employee records, payment information, credentials, intellectual property, contracts, backups, and configuration files. Record where each category is stored and who can access it.
- Dependencies: internet connections, domain names, identity providers, vendors, managed service providers, and integrations that would affect recovery.
For each item, record an owner, business purpose, location, sensitivity, users, support status, and recovery priority. Include the date last reviewed. A simple spreadsheet is better than an undocumented “complete” tool; the format matters less than accuracy and ownership.
Document governance and legal requirements
Decide who approves security policies, who can authorize emergency access, and who coordinates an incident. Document requirements that come from your country or state, sector regulators, contracts, payment arrangements, employment rules, and cyber-insurance policy. Notification duties after a breach depend on jurisdiction, industry, contracts, and the facts of the incident, so obtain qualified legal advice for your circumstances.
Use risk to set the first priorities
Rank systems by the harm caused if they are unavailable, altered, or exposed. Protect administrator accounts, email, financial systems, customer databases, and remote access first when they are central to your operations. Revisit the inventory after opening a location, adopting a service, changing a vendor, or retiring equipment.
How should a small business use MFA and least privilege?
Require MFA wherever a service supports it, beginning with administrators, email, file storage, sensitive information, and remote access. Give each person only the access needed for their role, and remove it promptly when that role changes or employment ends.
Choose an MFA method by risk and workflow
CISA says businesses should aim for phishing-resistant MFA. A hardware security token is one possible method; a FIDO2 security key can be practical when your identity provider, browsers, devices, and recovery process support it. It is an implementation option, not a universal requirement or a replacement for account-recovery planning.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| MFA approach | Phishing resistance | Compatibility and recovery questions | Deployment considerations |
|---|---|---|---|
| FIDO2 security key or other hardware token | Designed to resist common credential-phishing attacks when implemented correctly | Does the identity service support it? How will spare keys, lost keys, and recovery be handled? | Purchase, enrollment, storage of spares, and user training are required |
| Authenticator application approval or one-time code | Usually stronger than a password alone, but codes or approvals can still be targeted | What happens if a phone is lost, replaced, or offline? | Users need a supported phone and a documented recovery path |
| Text-message code | Less resistant to number-transfer and interception attacks than the methods above | Is the number current and controlled by the right employee? | Easy to start, but use a stronger available method for high-value accounts |
Do not let a single administrator own the only recovery factor. Keep an emergency process that verifies identity through a known channel, limits temporary access, records the action, and removes the exception afterward. Review sign-in logs and disable stale accounts, shared credentials, and unused administrator privileges.
Roll out MFA without locking out the business
- List every identity service and mark administrator, email, finance, customer-data, and remote-access accounts.
- Confirm which MFA methods each service supports and whether conditional access or device requirements are available.
- Enroll a small pilot group, including an administrator and a nontechnical user.
- Register a backup factor or spare key and test recovery before enforcing the policy.
- Set a deadline, communicate the reason, and provide a help channel for enrollment problems.
- Enforce MFA, review exceptions weekly during rollout, and remove temporary bypasses.
How do patching and maintenance prevent avoidable attacks?
Keep operating systems, applications, browsers, firmware, and security tools updated. Enable automatic updates where practical, but still verify that updates succeeded and that critical systems remain supported.
Make patching an inventory-driven process
- Match every installed system to an owner and support status in the asset inventory.
- Prioritize internet-facing, remote-access, identity, email, browser, and administrator systems.
- Use a maintenance window and a rollback or recovery option for business-critical software.
- Check that automatic updates are actually enabled and that devices have restarted when required.
- Replace or isolate unsupported operating systems and applications; an unpatched exception should have an owner, a reason, and an expiration date.
Security software cannot compensate for an operating system or application that no longer receives fixes. Include routers, printers, cameras, and other network-connected equipment in maintenance reviews, not just employee computers.
How do I create backups that can survive ransomware?
Back up important files and configurations regularly, and keep at least one copy disconnected from or isolated from the business network. CISA advises small and medium businesses and managed service providers to use automatic, continuous backups of critical data and configurations in an air-gapped location.
What makes a backup resilient?
- Coverage: include documents, databases, application data, identity configuration, and the information needed to rebuild a device or service.
- Isolation: maintain a copy that ransomware running on the network cannot rewrite or delete.
- Encryption and access control: protect backup data and restrict who can change retention or erase copies.
- Retention: keep enough historical versions to recover from a compromise that was not noticed immediately.
- Restoration: document who can restore, where credentials are kept, how long recovery should take, and how integrity will be checked.
| Backup approach | Isolation | Restore and retention questions | Administration |
|---|---|---|---|
| External hard drive | Only isolated when disconnected and stored securely; a permanently attached drive can be encrypted with the network | How often are copies made? Which versions are retained, and can a replacement computer read them? | Someone must rotate drives, protect them physically, encrypt them, and test restores |
| Network or cloud backup service | Depends on immutable or isolated copies and separate administrative credentials | What is the recovery time, capacity limit, retention policy, and process for a large restore? | Monitor failed jobs, account permissions, storage growth, and provider terms |
| Air-gapped or otherwise isolated repository | Strongest separation when access is tightly controlled and the repository is not continuously reachable | How quickly can it be connected and restored during an outage? | Requires documented procedures, protected credentials, and periodic recovery exercises |
Buying a drive alone is not a backup strategy. Schedule automatic copies, alert on failures, encrypt portable media, and perform test restores. A backup that has never been restored is an assumption, not evidence of recoverability.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How should I train employees to stop phishing?
Use recurring, role-specific training and give everyone a simple way to report suspicious messages. The goal is not to blame a person who clicked; it is to shorten the time between a warning sign and a protective response.
Teach the checks that matter
- Inspect the sender address and the destination of links rather than trusting display names or familiar logos.
- Treat unexpected invoices, gift-card requests, password resets, payroll changes, and urgent secrecy as high-risk.
- Do not enter credentials after following an unsolicited link. Open the known service directly instead.
- Verify unusual requests for money, sensitive information, or account changes through a known phone number or separate trusted channel.
- Report the message using the company’s stated process, even if the employee already clicked or replied.
Make reporting and response practical
Publish one reporting address, button, or phone route and state what happens next. Supervisors should know how to isolate a device, revoke a session, reset credentials, and preserve the message for investigation. Repeat short lessons when a new scam targets your sector or when employees change roles.
How do I secure business networks and sensitive data?
Harden the network’s entry points, separate untrusted devices from business systems, and limit sensitive data to people and services that need it.
Secure Wi-Fi and network equipment
- Change router and access-point default administrator names and passwords.
- Use WPA2 or WPA3 encryption, with a long unique network passphrase.
- Disable remote management when it is not needed; if it is required, restrict it and protect it with MFA.
- Provide a separate guest Wi-Fi network that cannot reach internal business systems.
- Remove unused services, ports, and accounts, and keep network firmware updated.
Protect data throughout its life cycle
- Classify sensitive information and define who may view, edit, export, or delete it.
- Encrypt sensitive data in transit and at rest where the service or device supports it.
- Use unique accounts rather than shared logins, and review access when people change jobs.
- Limit downloads and removable-media use for high-value data; securely dispose of devices and paper records.
- Review vendors that handle your data and put security requirements, incident contacts, access limits, retention, and deletion terms in writing.
For a provider or managed IT partner, compare the scope of its access, documented controls, incident support, data handling, subcontractors, and contract terms. Do not grant broad standing administrator access merely for convenience.
How can a business monitor, respond to, and recover from an incident?
Monitoring should reveal unauthorized access and unusual activity, while a written incident plan assigns decisions before an emergency. The plan should cover containment, continuity, communications, evidence preservation, and recovery.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Define signals and responsibilities
Review available sign-in, endpoint, email, firewall, backup, and cloud-service alerts. Decide who receives high-severity notifications outside business hours. Record contacts for leadership, IT, legal counsel, insurance, critical vendors, law enforcement, and communications support. Keep an offline or otherwise accessible copy of the plan in case normal accounts are unavailable.
Use an incident sequence
- Confirm: record what was observed, when, which systems are involved, and who noticed it.
- Contain: isolate affected devices or accounts, preserve relevant evidence, and avoid destroying logs.
- Eradicate: remove malicious access, patch the exploited weakness, rotate credentials, and check for persistence.
- Continue operations: switch to documented manual or alternate processes while protecting safety and sensitive information.
- Communicate: use approved internal and customer messages; obtain legal guidance before making notification decisions.
- Recover: restore clean systems and data, verify integrity, monitor closely, and document remaining risks.
- Improve: hold a lessons-learned review and update controls, training, contacts, and the plan.
Test the plan and restore procedures, then update them after major technology, staffing, or vendor changes. A plan that exists only in an employee’s memory will fail when that person is unavailable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is a realistic 90-day implementation plan?
A staged plan creates immediate protection without waiting for a perfect security program.
| Time frame | Priority actions | Evidence to keep |
|---|---|---|
| Days 1–30 | Assign an owner; inventory accounts, devices, services, and sensitive data; enforce MFA on administrators, email, remote access, and file storage; verify backups; change network defaults. | Inventory with owners, MFA enrollment record, backup-job status, and approved access list |
| Days 31–60 | Patch and retire unsupported systems; separate guest Wi-Fi; classify sensitive data; publish phishing-reporting instructions; review vendor access and contracts. | Patch exceptions, network configuration, data-access rules, training materials, and vendor requirements |
| Days 61–90 | Test a restore; run an incident exercise; review alerts and privileged accounts; document continuity and communications; fix gaps found in the exercise. | Restore result, exercise record, revised incident plan, and remediation owners |
After the first 90 days, set review intervals that match the business’s risk and change rate. Recheck controls when systems, vendors, locations, or regulations change rather than treating the baseline as a one-time project.
Can a small business do this without an internal security team?
Yes, but it still needs an accountable business owner and enough understanding to verify that work was completed. A managed IT or security provider can help with monitoring, patching, MFA rollout, backups, and response, but outsourcing does not transfer responsibility for risk, legal duties, or customer communication.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Before hiring a provider, ask which staff can access your systems, how privileged access is approved and logged, how backups are isolated, how incidents are escalated, what evidence and reports you receive, and how the contract handles termination and data return. Require security commitments in writing and review them when services or scope change.
How should I adapt this baseline to my business?
This guidance is general U.S. federal small-business advice. It does not determine the requirements for a particular country, state, industry, company size, infrastructure, contract, or insurance policy. Map the seven practices to your actual systems and obligations, then obtain qualified technical or legal advice where a mistake could create safety, regulatory, or contractual exposure.
Frequently Asked Questions
How often should a small business review its cybersecurity baseline?
Review it whenever you add or retire a system, change a vendor, move offices, alter sensitive-data handling, or change key staff. A scheduled management review between those events helps catch stale owners, accounts, and recovery contacts.
Recommended Free Tools
What should I do if an employee reports clicking a suspicious link?
Ask the employee to stop entering information and contact the designated response person immediately. Disconnect the device from networks if instructed, preserve the message and time details, and reset potentially exposed credentials from a known-clean device rather than waiting to see whether anything happens.
Does cyber insurance replace security controls?
No. Policies commonly impose their own safeguards, reporting windows, and cooperation duties, and coverage depends on the policy and incident facts. Treat insurance as one part of financial risk management while maintaining MFA, patching, backups, training, and response procedures.
What should a vendor security review ask for?
Ask for the provider’s access model, MFA and least-privilege practices, backup isolation, logging, incident-notification process, subcontractor use, data location and retention, and secure return or deletion at contract end. Match the requested evidence to the sensitivity of the data and the provider’s role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
