Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most effective way to prepare a small business for a cyber attack is to work in this order: secure important accounts with phishing-resistant multi-factor authentication (MFA), maintain recoverable backups, keep systems updated, make suspicious-activity reporting easy, and rehearse a short incident plan. Those controls reduce the chance that one stolen password becomes a business-wide outage and give you a way back if ransomware or another attack succeeds.
This is general, U.S.-oriented preparedness guidance. Reporting duties, privacy rules, contracts, and law-enforcement contacts depend on your industry and location, so involve qualified counsel or the relevant regulator when an incident requires it.
Why a small business needs a written cyber-attack plan
Small companies often depend on a few email accounts, cloud services, payment systems, shared files, and outside IT providers. An attacker who takes over one administrator, remote-access, or email account may be able to reach several of those systems. A written plan turns an improvised crisis into a sequence of decisions: who declares an incident, who calls the IT provider, who communicates with employees and customers, who obtains legal advice, and who decides how the business continues operating.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Cybersecurity and Infrastructure Security Agency (CISA) says smaller organizations can begin with a simple plan and improve it over time. CISA’s May 23, 2023 supply-chain fact sheet cited Small Business Administration figures of more than 31.7 million small and medium-sized businesses, 41.7 percent of private-sector employees, and nearly half of U.S. GDP. The measurement year was not shown in the cited result, so those figures should not be treated as current-year statistics without checking the original SBA publication. The practical point remains: a disruption at a small company can affect employees, customers, suppliers, and critical services.
#1 Best Overall
Preparation is not a promise that an attack will never happen. It is a way to limit access, notice trouble sooner, restore trustworthy systems, and keep making essential decisions under pressure.
Start with a short business inventory
Before buying tools or writing a long policy, make a one-page inventory. It can be a spreadsheet or document, provided someone keeps it current and it is protected like sensitive information.
Record the systems that matter
- Business email, identity-provider, and administrator accounts.
- Remote-access tools, virtual private networks, remote desktops, and vendor portals.
- Cloud file storage, collaboration systems, accounting, payroll, customer-management, and payment services.
- Laptops, desktops, servers, network equipment, phones, and other devices used for business.
- Critical data such as customer records, financial information, contracts, intellectual property, and operational files.
- Outside IT providers, managed service providers (MSPs), software vendors, and consultants with access to systems.
Set a recovery order
Mark which systems must return first for the business to operate. For example, an organization might need identity and email before it can coordinate staff, then file access or a line-of-business application, followed by less urgent archives. This is a business decision, not a technology ranking. Ask each process owner what a one-day, three-day, or longer outage would prevent, and record dependencies.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsProtect the inventory itself
Limit editing rights, keep a dated copy, and avoid storing administrator passwords in the same unprotected file. The inventory should help responders find accounts, devices, providers, and recovery dependencies without giving an attacker a ready-made map.
Secure accounts before doing anything else
Stolen credentials are a common route into business systems. Turn on MFA wherever a provider supports it, starting with administrator, remote-access, email, file-storage, and sensitive-data accounts. Use separate privileged accounts for administrative work and ordinary accounts for daily tasks, and give each person only the access required for the job.
Choose MFA by phishing resistance
CISA’s listed order of protection places a supported physical security key first, followed by an authenticator app with number matching, an authenticator app with one-time codes, biometrics when paired with another method, and text or email codes. A security key can provide the strongest phishing protection, but verify compatibility with your identity provider, operating systems, browsers, and account-recovery process before purchasing one.
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
| MFA method | Relative protection in CISA’s guidance | Implementation consideration |
|---|---|---|
| FIDO2-compatible physical security key | Strongest listed option; best protection against phishing | Confirm provider and device compatibility; plan for spare keys and account recovery |
| Authenticator app with number matching | Strong protection, below a security key | Ensure users understand number-matching prompts and how to report unexpected requests |
| Authenticator app with one-time codes | Protection below number matching | Protect enrollment and recovery codes; avoid sharing codes with anyone |
| Biometrics paired with another method | Useful as a paired factor | Use according to the device and identity provider’s supported configuration |
| Text or email codes | Weaker protection | Use only when stronger methods are unavailable, and move to a stronger method when possible |
Harden administrator and remote access
- Require MFA for every administrator and remote-access account, including accounts used by outside providers.
- Keep administrative accounts separate from everyday email and web-browsing accounts.
- Remove former employees promptly and review dormant accounts.
- Use least privilege: a provider or employee should receive only the systems and permissions needed for the assigned work.
- Review who can reset passwords, enroll new MFA devices, create users, or disable security logging.
MFA lowers account-takeover risk but does not replace updates, backups, monitoring, or staff reporting. Attackers can still exploit vulnerable software, steal active sessions, or persuade a user to approve an unexpected sign-in.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep software and devices maintained
Enable automatic updates where practical, establish a routine for updates that require approval, and replace software or devices that no longer receive security fixes. CISA places updates alongside MFA, backups, and employee awareness in its small-business resources.
Use a maintenance register
- List operating systems, business applications, network devices, security tools, and firmware versions.
- Record the vendor’s support status and the person responsible for updates.
- Prioritize internet-facing systems, remote-access tools, browsers, email clients, and identity services.
- Test important updates on a representative device or user group when an update could interrupt operations.
- Document exceptions, their business reason, and a date for removing the exception.
Unsupported software is not automatically compromised, but it leaves the business without a reliable source of security fixes. Replacement planning belongs in the budget and continuity discussion rather than waiting for an emergency.
Build backups that can actually restore the business
Back up critical data and system configurations automatically and frequently. Keep a copy isolated or air-gapped where feasible, and verify that the business can retrieve it. CISA’s ransomware guidance includes offline and cloud-to-cloud approaches; a backup that an attacker can alter or delete with the same credentials as production data is not a sufficient recovery plan.
Decide what to back up
- Business documents, databases, customer and financial records, and application data.
- Configuration files for servers, network devices, cloud services, and security systems.
- Identity and access information needed to rebuild accounts, while storing secrets securely and separately.
- Critical software installers, licensing information, and documented recovery procedures.
Use more than one recovery location
Maintain the working backup needed for routine restoration and an isolated copy that ransomware cannot reach through ordinary administrator credentials. Cloud-to-cloud backup can protect cloud data from accidental deletion or provider-side retention limits, while an offline or air-gapped copy provides separation from an active network intrusion. The right combination depends on the systems and risks in your inventory.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTest retrieval, not just backup completion
- Select a representative file, application, and configuration.
- Restore them to a safe test location or a separate device.
- Check that files open, permissions are correct, and applications can use the restored data.
- Measure how long the process takes and record the people and credentials required.
- Fix failures, update the procedure, and repeat on a schedule.
There is no universal recovery-time target or budget that fits every small business. Set targets from the recovery order in your inventory and the amount of downtime each process can tolerate.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Improve detection and make reporting easy
Training employees to recognize suspicious messages is important, but training is not a substitute for technical controls. Give staff a simple, non-punitive way to report phishing, unexpected MFA prompts, lost devices, unusual payment requests, or files that suddenly cannot be opened.
Enable and protect logs
Turn on logging for important servers, endpoints, network devices, and cloud services where those options are available. Assign someone to review alerts and unusual activity. Protect logs from unauthorized access or deletion, because an attacker who can erase evidence can delay detection and investigation. CISA’s small-business logging guidance points to its no-cost Logging Made Easy tool as one possible starting point.
Define what deserves immediate escalation
- An administrator or remote-access login from an unexpected location.
- Repeated MFA prompts the user did not initiate.
- New accounts, forwarding rules, applications, or privileged permissions.
- Security tools disabled or logs suddenly missing.
- Many files renamed, encrypted, or inaccessible.
- Unexpected payment instructions or changes to supplier bank details.
Do not require employees to prove that an alert is real before reporting it. The response team can investigate; early notice is more valuable than a perfect first diagnosis.
Write an incident plan people can execute
A useful plan is short enough to open during a crisis. CISA recommends that smaller organizations start simply and practice at least annually.
Assign decisions and contact methods
- Incident coordinator: declares an incident, sets priorities, and maintains the action log.
- Technology lead: works with internal IT or the MSP to contain the problem, preserve evidence, and restore systems.
- Communications lead: prepares employee, customer, supplier, and public updates through approved channels.
- Legal or privacy adviser: assesses reporting, contractual, privacy, and regulatory obligations.
- Business-continuity lead: decides how essential work continues while systems are unavailable.
- Executive decision-maker: approves major service shutdowns, spending, and risk decisions.
Write primary and backup contacts, phone numbers, secure alternate communication methods, and the MSP’s escalation path. Do not rely on the affected email system as the only way to reach responders.
Include a first-hour checklist
- Record the time, symptoms, affected users, devices, and systems.
- Notify the incident coordinator and technology lead using the out-of-band contact method.
- Protect safety and business-critical operations; isolate affected systems when the technology lead determines it is safe and useful.
- Preserve relevant logs, messages, alerts, and ransom notes. Do not wipe or rebuild systems before responders decide what evidence is needed.
- Contact the MSP, security provider, legal adviser, and other named specialists.
- Decide what employees should stop doing, such as signing in to a suspected account or reconnecting an affected device.
- Set the next update time and keep a decision and evidence log.
Practice at least once a year
Run a simple walk-through involving the people named in the plan. Use a realistic scenario such as a compromised email account or unavailable business files. Check whether everyone can find the contact list, identify who can authorize isolation, access backups, communicate without the normal email system, and make continuity decisions. Update the plan after the exercise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the MSP part of your security boundary
An MSP or other IT provider may administer identity, endpoints, backups, networks, and cloud services. Treat that access as part of your attack surface and your recovery plan.
Questions to ask before signing or renewing
- Which systems, accounts, and data can the provider access?
- Are provider accounts protected by MFA, and can the provider use phishing-resistant methods?
- How are permissions limited, reviewed, and removed when staff or contracts change?
- Which backups are automatic and continuous, where are they stored, and which copy is isolated or air-gapped?
- How often are restorations tested, and who performs them?
- Which logs are retained, for how long, and who can delete or alter them?
- Who leads containment, notification, and recovery during an incident?
- What response times, contacts, and customer responsibilities are written into the agreement?
CISA’s MSP guidance emphasizes automatic, continuous backup of critical information and configurations, MFA, limited permissions, and an air-gapped backup location. Your contract should make those responsibilities concrete rather than assuming that “managed” means “fully protected.”
A practical ransomware readiness sequence
Ransomware preparation combines the controls above because the attacker may encrypt files, steal data, disable recovery, or use a compromised account to spread.
- Inventory: identify critical files, applications, accounts, devices, providers, and recovery order.
- Limit entry: enable MFA, separate privileged accounts, remove unnecessary access, and update exposed systems.
- Preserve recovery: automate backups, keep an isolated copy, and test restoration.
- Increase visibility: enable logs, protect them, review alerts, and teach staff how to report suspicious activity.
- Prepare decisions: document isolation authority, provider contacts, legal advice, communications, and continuity actions.
- Rehearse: walk through unavailable files or a compromised account at least annually.
If ransomware indicators appear, follow the incident plan rather than negotiating or restoring from an unverified source on the spot. Involve the IT provider and legal adviser, preserve evidence, and make restoration decisions based on trustworthy backups and the business’s continuity priorities.
What to do after a cyber attack
During the first hours
Activate the named coordinator, document what is known, and use a communication channel that the attacker is unlikely to control. Contact the IT provider and legal adviser. Identify affected accounts and systems, contain access under technical guidance, and preserve logs and messages. Tell staff exactly what to stop doing and where to report new symptoms. Avoid making broad public claims before facts and legal obligations are understood.
Before restoring systems
Confirm the scope of the compromise, reset or disable affected credentials, and verify that restored systems and backups are trustworthy. Recheck MFA enrollment, administrator permissions, forwarding rules, remote-access accounts, and logging before reconnecting systems. Restore in the order established by the business inventory, testing each service before depending on it.
After operations resume
Record the timeline, decisions, evidence, costs, service interruptions, and communications. Determine whether customers, employees, partners, regulators, or law enforcement must be notified under applicable rules. Ask the IT provider what access was used and what controls failed. Update the inventory, backups, account protections, monitoring, contracts, and incident plan, then rehearse the revised process.
Common preparation mistakes
- Relying on passwords alone: start MFA with administrator, email, remote-access, file-storage, and sensitive-data accounts.
- Assuming a backup is usable: perform test restores and keep an isolated copy.
- Giving an MSP unlimited access: limit permissions, require MFA, and review provider accounts.
- Training without controls: combine awareness with updates, MFA, backups, and logging.
- Keeping the plan in the affected system: maintain an accessible offline or alternate copy and out-of-band contacts.
- Waiting for a perfect plan: begin with a short plan, practice it annually, and improve it after exercises or incidents.
- Buying insurance as a security strategy: insurance may be an optional risk-transfer decision, but it does not replace access controls, recovery capability, or response planning.
Small-business readiness checklist
- Critical accounts, devices, data, providers, and recovery order are documented.
- MFA is enabled for administrator, remote-access, email, file-storage, and sensitive-data accounts.
- A phishing-resistant method is used where the identity provider and devices support it.
- Privileged access is separate, limited, and reviewed.
- Automatic updates are enabled where practical, and unsupported systems have replacement dates.
- Critical data and configurations are backed up frequently.
- An isolated or air-gapped copy exists where feasible.
- Restoration has been tested and the retrieval steps are documented.
- Important systems generate logs, and logs are protected from deletion or alteration.
- Employees know how to report suspicious messages, MFA prompts, lost devices, and unusual activity.
- The incident plan names technology, communications, legal, continuity, executive, and provider contacts.
- The plan includes an alternate communication method and is practiced at least annually.
- MSP permissions, MFA, backup isolation, logging, restoration, and response duties are written down.
The Bottom Line
Prepare in layers: protect accounts, maintain systems, preserve isolated and tested backups, improve reporting and visibility, and rehearse a simple response plan with your staff and providers. That sequence gives a small business the best chance of limiting an attack and returning to dependable operations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
