iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with the controls that stop the most common paths into a small business: require multifactor authentication (MFA), use unique passwords, patch or replace unsupported technology, train staff to report phishing, maintain isolated and tested backups, secure Wi-Fi and devices, restrict access, and document incident response. Then review suppliers and legal or contractual obligations. This is a practical risk-management baseline—not a guarantee against attacks or a universal compliance checklist.
What cybersecurity protections should a small business set up first?
Work in this order:
- Secure accounts: Turn on MFA for email, file storage, remote access, administrator accounts, and systems containing sensitive data. Start with privileged and remote access.
- Make credentials unique and manageable: Use a password manager, never reuse work passwords, and require strong passwords.
- Patch everything you still support: Enable automatic updates where practical and replace unsupported operating systems, applications, and hardware.
- Build a reporting culture: Train employees to spot and report suspicious messages and verify unusual requests through a known contact method.
- Back up for recovery, not just storage: Keep protected, isolated copies of critical data and configurations, and test that they can actually be restored.
- Harden networks and devices: Change default router credentials, use current Wi-Fi encryption, separate guests, encrypt devices, and control physical access.
- Limit privileges and retain visibility: Give each person only the access required for the role, collect useful logs, and protect those logs.
- Prepare response and recovery: Assign decision-makers, contacts, restoration steps, and communication responsibilities before an incident.
- Review suppliers: Understand how managed IT providers, cloud services, payroll systems, and other vendors protect access, backups, updates, and incident response.
These controls should be scaled to the information you hold, the systems you depend on, your staffing and budget, and the laws or contracts that apply to your business. The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 is a flexible way to organize that work. Its functions—Govern, Identify, Protect, Detect, Respond, and Recover—are planning categories, not a one-size-fits-all certification.
A practical implementation order
First 24 hours: close the easiest entry points
- List administrator, email, remote-access, cloud-storage, banking, payroll, and customer-data accounts.
- Enable MFA on administrator and remote-access accounts first, then on email and file storage.
- Change reused or default passwords, especially for routers, administrator accounts, and shared services.
- Confirm that your most important files are being backed up and identify where the recovery copy is kept.
- Tell employees exactly where to report suspicious messages and payment requests.
First 30 days: establish repeatable controls
- Inventory devices, software, cloud services, vendors, and sensitive data.
- Set an update policy and replace technology that no longer receives security fixes.
- Deploy a password manager and migrate accounts away from shared or reused passwords.
- Harden Wi-Fi, encrypt laptops and removable media, and create a guest network where appropriate.
- Configure automatic or continuous backups for critical data and system configurations, including a copy isolated from normal network access.
- Run a restoration test and record how long it takes and what was missing.
- Write a short incident-response plan with named owners and outside contacts.
Every quarter: verify rather than assume
- Review who has administrator, remote, financial, and sensitive-data access; remove accounts and permissions no longer needed.
- Check MFA enrollment, backup status, update compliance, endpoint encryption, and router settings.
- Run a phishing-reporting exercise or refresher and review what employees found confusing.
- Test restoration of a representative file and, periodically, a larger system or configuration.
- Recheck supplier contacts, contracts, recovery commitments, and breach-notification procedures.
- Exercise the incident plan with the people who would make decisions and communicate with customers.
1. Secure the accounts that open the door
MFA requires more than a password—usually a second factor such as a security key, an authenticator app, or a code. A stolen password alone is less useful when MFA is enforced. Apply it broadly to business email, file storage, remote desktop or VPN access, administrator consoles, financial services, and any account holding sensitive information.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrioritize privileged and remote access
Begin with accounts that can change systems or reach the network from outside the office. Then cover ordinary employee accounts. Do not leave a shared administrator login protected only by a password; create named administrator accounts so access can be assigned and revoked individually.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Choose the strongest practical method
CISA advises aiming for phishing-resistant MFA. In general, the preference order is physical security keys, authenticator apps with number matching, authenticator apps that generate one-time codes, and text or email codes. The exact choice depends on whether each service and device supports it. A FIDO2-compatible security key is an implementation option only for services that accept that standard.
| MFA method | Phishing resistance | Rollout and recovery considerations |
|---|---|---|
| Physical security key | Strongest among the listed options when supported | Requires compatible services and devices; issue spare keys and document replacement or lockout procedures. |
| Authenticator app with number matching | Stronger than a simple code, but users can still approve an unexpected prompt | Requires compatible app and phone; train staff never to approve an unrequested prompt. |
| Authenticator app with one-time code | Better than password-only access, but codes can be phished | Plan enrollment, phone loss, backup codes, and account recovery. |
| Text or email code | Weaker and more exposed to interception or account takeover | Use when stronger methods are unavailable, then plan a migration. |
Make enrollment and recovery part of the control
- Require each employee to enroll a factor before receiving access to sensitive systems.
- Keep recovery codes in a protected location; do not put them in the same account they unlock.
- Provide at least one documented process for a lost phone or security key, with identity verification by a person who is not the requester.
- Review MFA logs for repeated denied prompts or new-device enrollments.
2. Use unique passwords without creating chaos
Never reuse a password between business email, cloud services, banking, remote access, and personal accounts. A password manager can generate and store unique credentials so staff do not have to memorize dozens of passwords. It does not replace MFA: the manager account itself needs a strong, unique password and MFA.
FTC guidance recommends strong passwords and describes a minimum length of 12 characters. Use longer passphrases where the service permits them, avoid predictable company names or seasonal changes, and do not share credentials through chat or spreadsheets. Shared access should use delegated roles or a controlled vault rather than a common password whenever the service supports it.
Recommended Free Tools
Password-manager rollout checklist
- Choose a business-managed vault with individual accounts, administrative recovery, access logs, and MFA support.
- Set a strong master passphrase and enroll more than one recovery method under controlled procedures.
- Import or reset the most important accounts first: email, identity administration, finance, remote access, and backups.
- Remove passwords from browsers, unencrypted documents, scripts, and old onboarding files.
- When someone leaves, disable the person’s vault account and rotate any credentials they could view.
3. Patch systems and remove unsupported technology
Enable automatic updates for operating systems and applications when possible. Keep browsers, security software, routers, phones, and firmware current as well. Updates close known weaknesses; an unsupported operating system or application may never receive the fix you need.
Build a simple asset and update list
| Record | What to capture |
|---|---|
| Device or service | Owner, location, business purpose, and whether it stores or accesses sensitive data |
| Software and version | Operating system, major applications, browser, security tools, and firmware |
| Support status | Whether the supplier still provides security updates and the end-of-support date if known |
| Update method | Automatic, centrally managed, or a named person’s manual responsibility |
| Exception | Why an old system remains, who accepted the risk, and the replacement deadline |
Replace unsupported technology rather than leaving it exposed indefinitely. If replacement cannot happen immediately, isolate the system, restrict its network access, remove unnecessary accounts, and document the temporary risk and deadline.
4. Make phishing reporting normal work
Training should cover suspicious links and attachments, urgent requests, unexpected invoices, login prompts, gift-card or wire-transfer demands, and messages that imitate an executive or supplier. Short, recurring instruction is more useful than a single annual presentation.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Give employees a safe decision path
- Stop: do not click, open an attachment, reply, or enter credentials.
- Check: inspect the sender and destination without trusting the message’s contact details.
- Report: use the business’s designated mailbox, button, ticket queue, or phone number.
- Verify: confirm unusual payment, payroll, bank-detail, or data requests through a known phone number or previously established channel.
- Escalate quickly if anyone clicked, entered a password, approved an MFA prompt, or transferred money.
Make reporting non-punitive. Early notice gives the business a chance to revoke sessions, reset credentials, block a sender, contact a bank, or preserve evidence.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →5. Protect and test backups
A synchronized folder or ordinary cloud copy is not automatically a resilient backup. If ransomware or a compromised administrator can reach every copy, the copies may be encrypted or deleted together. Back up critical files and system configurations automatically or continuously where practical, retain historical versions, encrypt the data, and keep at least one copy isolated from ordinary network access.
| Backup question | What a sound answer includes |
|---|---|
| What is covered? | Customer and financial records, operational files, identity or application configurations, and any data required to resume essential work. |
| How often? | A frequency matched to how much data the business can afford to lose; critical systems may need automatic or continuous protection. |
| Can an attacker reach it? | At least one copy is isolated, offline, or otherwise protected from ordinary production credentials and network access. |
| How long is it retained? | Enough historical versions to recover from delayed discovery, subject to business, legal, and contractual needs. |
| Has recovery been tested? | Yes—restore files and configurations, verify integrity, measure time, and record failures and corrective actions. |
Run a restoration test
- Select a representative file set and one critical configuration or application.
- Restore to a clean, separate location rather than overwriting the production copy.
- Open files, check permissions and dates, and confirm that the application or system starts as expected.
- Record the recovery time, missing dependencies, and who performed each step.
- Fix the process and repeat after major system or provider changes.
An external drive can be one component of a backup workflow, but it must be encrypted, protected from theft, rotated or disconnected as appropriate, and included in restoration tests. Keep backup administration separate from ordinary user accounts.
6. Secure Wi-Fi, devices, and physical records
Harden the router and wireless network
- Change the router’s default administrator name and password.
- Turn off remote administration unless it is required; if it is required, restrict it and protect it with MFA where supported.
- Use WPA2 or WPA3, with a strong wireless passphrase.
- Update router firmware and replace equipment that no longer receives fixes.
- Limit which devices can join the business network and remove former devices.
- Create a separate guest network for visitors or personal devices when appropriate; do not give guests access to internal systems.
Protect endpoints and removable media
Encrypt laptops, phones, tablets, and removable drives that contain sensitive information. Use screen locks, automatic lock timeouts, endpoint security updates, and remote-wipe capability where available. Keep devices containing sensitive data out of unattended vehicles and public areas. Lock paper files and control access to offices, server closets, backup media, and printed customer records.
7. Limit access and retain useful visibility
Use least privilege: each person should have only the data and systems required for the role. Separate everyday work from administrator duties, review shared accounts, and remove access promptly when someone changes roles or leaves.
Logging and monitoring that a small business can sustain
- Record successful and failed logins, MFA changes, administrator actions, privilege changes, backup failures, and security-alert events.
- Protect logs from unauthorized alteration or deletion, ideally by sending them to a separate service or account.
- Set retention based on business policy, legal or regulatory duties, contracts, storage capacity, and the time needed to investigate an incident.
- Assign someone to review important alerts; collecting logs without anyone acting on them provides little protection.
Start with visibility into the systems that would most disrupt the business rather than trying to monitor everything equally.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
8. Write and exercise an incident-response plan
Ask, in advance, “How will your business respond to a security incident?” A useful plan says who can declare an incident, who can disconnect systems, who contacts IT or an outside responder, how essential work continues, how data is restored, and who communicates with employees, customers, insurers, regulators, law enforcement, or contractual partners when appropriate.
Minimum plan contents
- Roles: an incident lead, technical decision-maker, business owner, communications contact, and backup contacts.
- Triggers: examples such as ransomware, a lost encrypted laptop, a compromised email account, suspicious payment instructions, or a vendor breach.
- First actions: preserve evidence, isolate affected devices when safe, revoke tokens, reset credentials from a clean device, and contact financial institutions quickly when money is at risk.
- Continuity: the manual or alternate process for serving customers, paying staff, taking orders, or communicating if systems are unavailable.
- Recovery: the order for restoring identity, networking, applications, data, and user access, with validation after each stage.
- Notification: decision criteria and contact details for customers, insurers, regulators, authorities, and suppliers. Duties vary by jurisdiction, industry, contract, and the information involved.
Test the plan with relevant employees and providers. Update names, phone numbers, access procedures, and recovery steps after the exercise.
9. Review third-party and managed-service risk
List every provider whose systems or access could affect operations: email and storage services, payment and payroll platforms, web hosts, software suppliers, managed IT providers, backup services, and outsourced support. For each, document what the provider secures and what remains your responsibility.
| Question for a provider | Why it matters |
|---|---|
| Which staff or subcontractors can access our systems, and how is privileged access controlled? | Limits unnecessary and untraceable access. |
| Is MFA required for administrative and support access? | Reduces the risk of a stolen provider credential opening your environment. |
| How are updates, vulnerabilities, and unsupported components handled? | Shows whether known weaknesses are addressed on a defined schedule. |
| What backups exist, where are they isolated, and how often is restoration tested? | Clarifies whether the provider can help recover after deletion or ransomware. |
| Who is the incident contact, how quickly is it staffed, and what information will be shared? | Prevents delays when an incident occurs outside business hours. |
| What are the termination and data-return procedures? | Helps the business leave a provider without losing access or records. |
An MSP or cybersecurity provider can supply implementation and response expertise when the business lacks it. The owner should still confirm the scope, privileged-access controls, backup and recovery commitments, response availability, and division of responsibilities in writing. Outsourcing work does not outsource accountability for business decisions.
How to tailor the checklist to risk and obligations
Start with the information and operations that would cause the greatest harm if exposed, altered, or unavailable. Consider customer and employee personal information, payment data, intellectual property, regulated records, safety-critical operations, and dependencies on a single supplier. Rank systems by business impact and apply stronger controls to the highest-impact group first.
NIST CSF 2.0 and the small-business guide associated with it are free, voluntary, and flexible. They can help organize a program, but they do not determine whether your business meets a specific privacy, payment, employment, health, government-contract, insurance, or breach-notification requirement. Ask qualified legal, compliance, or industry specialists about obligations that apply to your location and sector.
Common failure modes and fixes
- “We turned on MFA for one administrator account.” Expand it to email, storage, remote access, sensitive-data systems, and all staff accounts; prioritize phishing-resistant methods where supported.
- “Our files sync to the cloud, so backups are covered.” Add versioned, encrypted, isolated recovery copies and test restoration.
- “We have an old computer that still runs the business.” Replace unsupported technology; until then, isolate it and restrict its access under a documented, time-limited exception.
- “Employees know what phishing looks like.” Provide recurring examples, a one-step reporting channel, and a known method for verifying unusual requests.
- “The IT provider handles security.” Write down who handles MFA, patching, logs, backups, recovery, and incident communication, then verify those controls.
- “We collect logs but never review them.” Identify a small set of high-value events, assign an owner, protect retention, and define escalation.
- “The incident plan is in someone’s head.” Put contacts and recovery steps on paper or in an accessible offline format and exercise them.
Small-business cybersecurity maintenance checklist
| Frequency | Checks |
|---|---|
| Daily or automated | Backup jobs, security alerts, update status, endpoint protection, and unusual sign-ins. |
| Monthly | New and departing users, administrator access, failed backups, unsupported assets, router and Wi-Fi settings, and outstanding patches. |
| Quarterly | MFA coverage, access review, restoration test, phishing refresher, supplier contacts, and incident-plan exercise. |
| After a major change | Recheck integrations, privileges, backup scope, logging, recovery steps, and contractual or notification requirements. |
Keep a dated record of decisions, exceptions, tests, and corrective actions. The goal is not to buy every security product; it is to maintain controls that match the business’s real risks and can be operated consistently.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
