Cybersecurity Basics for Small Business: Where to Start

The short answer

A small business does not need a security department to block most common threats. Attacks on small companies are usually simple: a stolen password, a phishing email, an unpatched vulnerability, a lost laptop. Basic hygiene, done consistently, handles them.

The order of work:

1. Account inventory — know what you are protecting.
2. 2FA everywhere, starting with email.
3. Automatic updates on every device and service.
4. Backups you have restored at least once.
5. Access offboarding when someone leaves.
6. Device protection: encryption, screen lock, remote wipe.

Step 1. Account inventory

You cannot protect what you do not know about. Create one spreadsheet listing every company service: email, domain and DNS, hosting, CRM, accounting, online banking, social media, Telegram channels, ad accounts, cloud drives.

For each service record:

• who owns the account (a person, not "everyone");
• which email and phone number it is registered to;
• who else has access;
• whether 2FA is on.

A common discovery at this step is a domain or ad account registered to a former employee's or contractor's personal email. Move those to a company address first.

Step 2. 2FA everywhere

Two-factor authentication gives the biggest return for the effort. Even if a password leaks, nobody gets in without the second factor.

• Start with email, because it is how every other password gets reset.
• Then the domain, hosting, bank, CRM and social media.
• Use an authenticator app or a hardware key; keep SMS only where there is no alternative.
• Store the recovery codes somewhere safe.

Roll out a password manager (Bitwarden, 1Password or similar) at the same time. It ends password reuse and lets people share access without pasting passwords into a messenger.

Step 3. Updates

Many breaches exploit long-known vulnerabilities that already have patches.

• Turn on automatic updates for the OS, browsers and office software.
• Keep the website CMS and its plugins updated, and remove unused ones.
• Replace routers and devices that no longer receive updates.

Step 4. Backups

A backup protects against ransomware, human error and disk failure at once. Follow the 3-2-1 rule: three copies, two different media, one copy off-site.

At least one copy must be impossible to modify from work computers, otherwise ransomware will encrypt it too. Most importantly, test a restore every quarter. A backup that has never been restored is a hope, not a backup.

Step 5. Access offboarding

Departures are when access most often gets left behind. Keep a short offboarding checklist:

• disable company email and SSO;
• remove access listed in the Step 1 spreadsheet;
• change shared passwords the person knew;
• collect the laptop and phone or wipe company data from them;
• transfer ownership of files and channels.

If Google Workspace or Microsoft 365 is your single sign-on, disabling one account closes many services at once.

Step 6. Device protection

• Full-disk encryption (BitLocker, FileVault, built in on smartphones).
• Screen lock with a PIN or biometrics.
• Find-my-device and remote wipe enabled.
• The OS built-in antivirus turned on and updating.
• Employees work without administrator rights.

Who owns what

Also name one person employees can go to with "I got a strange email." That costs less than any technology.

Common mistakes

• Buying expensive tools before basic hygiene is in place.
• One shared password for the whole team.
• A backup drive permanently connected to the same computer.
• No owner: "everyone handles security" means nobody does.