Security6 min read

Seven security basics every small business needs

You don't need an enterprise security program. Most small business incidents come down to a handful of avoidable gaps. Work through these seven and you'll be ahead of most businesses your size.

The seven basics

Multi-factor sign-in on email, banking, accounting, and your website admin
A password manager, with no passwords in spreadsheets or sticky notes
Automatic updates on computers, phones, and your website software
Backups of important files that are kept separate and tested
Separate accounts for each person, and prompt removal when someone leaves
A guest Wi-Fi network for customers, separate from your business devices
A written plan for what to do if something goes wrong

Step by step

Protect your sign-ins
Multi-factor sign-in and a password manager together prevent most account takeovers. Start with email and anything involving money.
Keep software updated
Updates fix known holes that criminals actively use. Turn on automatic updates for operating systems and apps, and keep your website platform and plugins current.
Back up, and test the backup
Keep a copy of your important files somewhere that a single mistake or ransomware attack can't reach. Once a quarter, try restoring a file to make sure it really works.
Give each person their own access
Shared logins make it impossible to know who did what or to cut off a former employee. Give each person an account with only the access their job needs.
Separate guests from your business
Most routers can run a guest network in a few clicks. Customers and visitors use that one, while your computers, card terminals, and cameras stay on the main network.
Write down your 'if something goes wrong' plan
One page is enough: who to call, which accounts to lock first, how to contact your bank, and where the backups are. You don't want to invent this during a bad day.

Common mistakes to avoid

Assuming you're too small to be a target. Criminals scan for easy targets of every size
Using the same password everywhere
Ignoring update reminders for months
Never testing whether backups can be restored

Common questions

Where should I start if I only have an hour?

Turn on multi-factor sign-in for your email and banking, then set up a password manager. Those two steps remove the most common ways businesses get hacked.

Do I need cyber insurance?

It's worth a conversation with your insurance agent. Many policies now ask whether you use MFA and backups, so the basics above also help with coverage.