What are the basic cybersecurity steps for a small business?
CISA, a U.S. government agency, lists four essentials for small businesses: teach employees to avoid phishing, require strong passwords, require multifactor authentication and update business software. It then lists three further steps: logging, backing up business data and encrypting it. No checklist can promise to stop every attack, but these four are where CISA says to start.
Why a small business should start here
CISA's page for small businesses says "No business is too small to be a target", and that small and mid-sized businesses are especially vulnerable because they may not have as many resources to dedicate to cybersecurity. No checklist, this one included, can promise to stop an attack.
The four essentials, from CISA's page
- Teach employees to avoid phishing. CISA says phishing tricks employees into opening malicious attachments or sharing sensitive information, and that staff should be trained to recognize and report suspicious activity.
- Require strong passwords. CISA says to make them mandatory for all users.
- Require multifactor authentication (MFA). CISA says it adds an extra layer of security beyond passwords, and to use phishing-resistant MFA where available.
- Update business software. CISA says outdated software can contain exploitable flaws, and to promptly install security updates and patches.
The next steps CISA lists
As general advice, logging and encryption are usually settings inside the tools and devices themselves, so ask whoever supports them to confirm in plain words what is on and what is not. CISA lists these as the next steps:
- Use logging on business systems. CISA says to log activity so your team can monitor signs that threat actors may be trying to access your systems.
- Back up business data. CISA says that when you back up critical information, recovery is faster and less stressful.
- Encrypt business data. CISA says that even if criminals gain access to your files, encrypted information stays locked and unreadable.
Turn each step into a question
The questions below are general advice, not CISA's wording. The last row is not on CISA's page; it is added because accounts left open after someone departs can let access linger.
| Step | A question to ask | Where to read more |
|---|---|---|
| Phishing | If a message looks wrong, does each person know who to tell? | The related answer on spotting a fake invoice or payment-change email, one common scam |
| Passwords | Does anyone reuse a password or share one login? | The related answer on whether a business needs a password manager |
| MFA | Is it on for email, the bank and the website host? | The related answer on multi-factor authentication |
| Updates | Who updates the website, the computers and the phones, and who checks? | The related answer on what looking after a website involves (the website only) |
| Backups | Could you restore last week's customer records? | The related answer on backing up business data |
| People who leave | Is there a written list of accounts, so access can be removed the day someone goes? | The related answer on removing an employee's access |
If something has already gone wrong
CISA's page also asks businesses to plan how they would respond if systems went down, data was stolen or networks were compromised, and to practice that plan. This checklist is about before. If an account has already been taken over, the related answers cover what to do after: a hacked business email account, a hacked website, a hacked Facebook business page and a hacked Google Ads account.
Sources
Related answers
- What is multi-factor authentication, and should every business account use it?
- How should a small business back up its data?
- How do you remove an employee's access to accounts when they leave?
- Does a small business need a password manager?
- What should you do if your business email account is hacked?
- How do you spot a fake invoice or a payment-change email?
- What does looking after a small business website involve?
- How can you tell if your business website has been hacked, and what do you do first?
- What should you do if your Facebook business page is hacked?
- What should you do if your Google Ads account is hacked or shows charges you did not make?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.