Small Business Security: Questions and Answers
Practical, budget-aware cybersecurity answers for small business owners: where to start, staff training, policies, vendors and cloud accounts.
Where should a small business start with cybersecurity?
Start with the controls that stop the most common attacks: multi-factor authentication on email and finance accounts, automatic updates, tested offline backups, a password manager for staff, and a simple rule for verifying payment changes by phone. These cost little and cover most real incidents.
Full answer and next stepsHow much should a small business spend on cybersecurity?
There is no reliable universal percentage. Base the budget on what you need to protect and what an outage would cost you: start with free or already-paid controls (MFA, updates, built-in security features of your email and devices), then spend on backups, endpoint protection and training.
Full answer and next stepsAre small businesses really targeted by hackers?
Yes. Many attacks are automated and opportunistic, scanning the internet for weak passwords, unpatched systems and staff who will click a link, regardless of company size. Small businesses are also targeted for invoice fraud and as a route into larger customers and suppliers.
Full answer and next stepsHow do I train employees on cybersecurity without boring them?
Keep training short, frequent and specific to the work people do: how to spot invoice fraud for finance, how to report a suspicious email for everyone. Make reporting easy and thank people who report, including when they report their own mistake.
Full answer and next stepsWhat security policies does a small business need?
Most small businesses need a short acceptable use policy, a password and MFA policy, a backup policy, an incident response plan, a policy on approving payments, and, increasingly, an AI use policy. Each can be one page if it is clear about who does what.
Full answer and next stepsWhat is cyber insurance and does a small business need it?
Cyber insurance helps cover costs after an incident, such as investigation, recovery, legal advice, notification and sometimes business interruption. Whether you need it depends on your risk and contracts. Insurers usually require baseline controls such as MFA and backups before they will offer cover.
Full answer and next stepsHow do I secure Microsoft 365 or Google Workspace for a small business?
Require MFA for every user, use separate admin accounts with phishing-resistant MFA, turn off legacy sign-in methods, enable audit logging and alerts for suspicious sign-ins and forwarding rules, and configure SPF, DKIM and DMARC for your domain.
Full answer and next stepsHow do I securely offboard an employee who leaves?
On their last day, disable their accounts, revoke access to shared drives and SaaS tools, collect company devices, change any shared passwords they knew, and transfer ownership of their files and mailbox. A written checklist makes sure nothing is forgotten.
Full answer and next stepsHow do I check a software vendor’s security before signing a contract?
Ask for evidence rather than promises: a recent SOC 2 report or ISO 27001 certificate, how they handle and where they store your data, whether they support SSO and MFA, how they notify customers of breaches, and what happens to your data when the contract ends.
Full answer and next stepsWhen should a small business bring in a cybersecurity consultant?
Bring in outside help when you need an independent risk assessment, are preparing for a customer security questionnaire or certification such as SOC 2 or ISO 27001, are adopting AI tools that touch customer data, or have had an incident. A good consultant leaves you with a prioritized plan your team can run.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the Small Business Security guides.