Small Business Cybersecurity
Protect Your Business Before Attackers Strike
For owners, managers, staff, and anyone handling business operations
Action Guide
Foundations (do these first)
🔒 Passwords and Access
Enforce unique passwords. Use a business password manager. Remove access immediately when staff leave.
🛡 Multi-factor Authentication
Require MFA on all business email, cloud storage, and accounting tools — no exceptions.
🔄 Update Software Regularly
Enable auto-updates on all devices. Outdated software is the #1 entry point for attackers.
Data and continuity
💾 Back up regularly
Follow the 3-2-1 rule: 3 copies, 2 media types, 1 off-site or cloud. Test restoring capability quarterly. If using a cloud service, ensure it is a reputable provider — avoid free services with unclear privacy terms.
👤 Limit who can access what
Staff should only see the data their role requires — not everything on the system. Apply least-privilege access — give each person only the minimum access required for their current responsibilities.
🔐 Encrypt sensitive data
Enable encryption on devices, storage, and customer transactions. Essential for e-commerce — financial and personal data must be unreadable if accessed by hackers.
📶 Separate your networks
Run a separate Wi-Fi network for customers and guests. Never share the same network used for business systems with them — a compromised guest device could otherwise expose your entire business network.
Human risk
✉️ Phishing — the #1 way attackers get in
What it is
A deceptive email, text, or call that tricks someone into clicking a link, entering credentials, or transferring money — by pretending to be a trusted source like a bank, vendor, or colleague.
How it happens
An employee gets an urgent email from a "supplier" asking to confirm payment details. They click the link, enter their login — and attackers now have access. It takes seconds and no technical skill to fall for.
Stay safe
Never click links in unexpected emails — go directly to the website instead. Verify unusual requests by phone. Train staff regularly and run practice drills to build awareness before a real attack hits.
📋 Have an incident response plan
Know who to call if your system is breached. Write down steps: isolate the device, notify your IT contact, preserve logs. Do not wait until it happens.
🧑💻 Run phishing drills
Send simulated phishing emails to staff, review who clicked. Free tools like Google's Phishing Quiz make this easy to set up and run regularly.
Monthly checklist
☐ Confirm backups completed successfully
☐ Check for pending software and firmware updates
☐ Caution staff never to share passwords by email or chat
☐ Check login activity for any unusual or unexpected sign-ins
☐ Confirm that a backup can recover the system to a working state
☐ Check that sensitive customer or business data is stored securely
☐ Collect reports from staff on any suspicious emails or login attempts
☐ Check who has access to business accounts, remove unnecessary access
68%
of breaches involve a human element — phishing, stolen credentials, or error
Verizon Data Breach Investigations Report (DBIR) 2025
88%
of SMB breaches involve ransomware — vs. 39% at large enterprises
Verizon Data Breach Investigations Report (DBIR) 2025
$120k+
minimum realistic cost of a data breach for a small business — enough to threaten survival
Verizon DBIR 2024 · IBM Cost of a Data Breach Report 2024