Where should a small business start with cybersecurity?
Short answer
Start with the controls that stop the most common attacks: multi-factor authentication on email and finance accounts, automatic updates, tested offline backups, a password manager for staff, and a simple rule for verifying payment changes by phone. These cost little and cover most real incidents.
The details
Free government guidance, such as the NCSC Small Business Guide, CISA Cyber Essentials and the FTC’s small business pages, lays out these basics in plain language. Once they are in place, write down who to call in an incident and list the systems and data the business depends on.
What to do
- Turn on MFA for email, banking, payroll and cloud admin accounts.
- Enable automatic updates on every device.
- Set up backups with one copy offline, and test a restore.
- Give staff a password manager.
- Write a one-page incident contact list.
Useful next reads and tools
- Small Business Security guides · guide
- Website Security Check · tool
Terms explained
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- Password manager
- A password manager is an app that generates, stores and fills unique passwords and passkeys, protected by one strong master password and usually MFA.
Sources
Related questions
- What is the 3-2-1 backup rule?
- How much should a small business spend on cybersecurity?
- Are small businesses really targeted by hackers?
- How do I train employees on cybersecurity without boring them?
- What security policies does a small business need?
- What is cyber insurance and does a small business need it?
Related Guides
GuideSmall Business Security
Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
Read more GuideSmall Business Security
Small Business Cybersecurity Checklist: The Core Controls
A practical small business cybersecurity checklist covering access controls, patching, backups, encryption, and network defense to secure your business.
Read more GuideSmall Business Security
How to Implement Ransomware Prevention in a Small Business
Learn practical ransomware prevention for small businesses. Protect devices, configure offline backups, secure access, and build an effective defense plan.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more