Why small businesses get targeted
Small businesses often have valuable customer, employee, financial, and operational data, but fewer dedicated security resources. Attackers look for easy entry points: reused passwords, weak email protection, exposed remote access, unmanaged devices, and staff who have never been trained on phishing.
The goal is not to become perfect overnight. The goal is to reduce the easiest paths into the business first.
Step 1: Turn on MFA everywhere
Require multi-factor authentication for email, cloud apps, remote access, banking, accounting, admin panels, and password managers. Prioritize administrator accounts and accounts that can access sensitive customer or business data.
Avoid SMS where possible for privileged accounts. Use authenticator apps, hardware keys, or platform passkeys when available.
Step 2: Lock down administrator access
Identify every account with administrator rights. Remove admin rights that are not needed. Separate daily user accounts from admin accounts.
Review admin access monthly and immediately after employee departures, vendor changes, or suspected compromise.
Step 3: Protect email
Enable spam and phishing filtering, external sender banners, safe links or URL rewriting where available, attachment scanning, DMARC/SPF/DKIM alignment, and mailbox forwarding rule monitoring.
Most small business incidents start with email. A basic email security baseline is one of the highest return security investments.
Step 4: Secure devices
Require screen locks, disk encryption, endpoint protection, automatic patching, and remote wipe capability. Maintain a simple asset list of laptops, desktops, mobile devices, and critical network equipment.
Do not allow unknown personal devices to access sensitive business systems without basic controls.
Step 5: Back up critical data
Identify what data would stop the business if lost: billing data, customer files, scheduling, financial records, contracts, policies, and operational documents.
Use the 3-2-1 mindset: multiple copies, more than one storage location, and at least one copy that is protected from ransomware. Test restores, not just backups.
Step 6: Train people using real examples
Security training should be short, practical, and repeated. Use examples employees actually see: fake invoices, benefits emails, password reset prompts, and vendor payment changes.
Reward reporting. Do not shame employees for reporting a suspicious click quickly. Fast reporting reduces damage.
30-day action plan
Week 1: inventory accounts and devices. Week 2: enable MFA and review admin rights. Week 3: improve email protection and backup settings. Week 4: run a phishing tabletop and document next steps.
Schedule now