If you run a business with no security team, small business cybersecurity starts with a short baseline: multi-factor authentication on key accounts, tested off-site backups, endpoint protection, a firewall, and staff who can spot phishing.
Picture an owner who handles invoices, customer records and a shared email account on top of everything else. Security has to fit into spare hours, so this guide ranks the baseline by how much risk each step removes for the effort it takes, then points to deeper guides such as Cybersecurity Risk Assessment Checklist: A Practical 2026 Guide To Finding And Fixing Vulnerabilities – Hardcarsecurity once the basics are in place.
Choosing your starting route
Most small firms do not need a security programme on day one. They need a sensible order of work. The routes below run from the cheapest, highest-leverage changes to the slower, more structured ones. The ranking is an editorial judgement. It rests on how directly each control answers the attacks described in the next section, and on how little ongoing effort each one demands.
- Lock down sign-ins. Turn on multi-factor authentication for email, banking and finance platforms. It is a settings change rather than a project, and it protects the accounts attackers most want.
- Make backups recoverable. Keep copies off-site and prove they restore. This is the control that decides whether a ransomware incident is an inconvenience or a crisis.
- Cover every computer and the internet connection. Run endpoint protection on every business device and put a firewall on the internet connection.
- Train people and trim access. Teach staff to recognise deceptive messages and give each person only the access the job needs.
- Add structure. Use a recognised framework, a written risk assessment and, later, outside testing or managed help.
If you can only act this week, do the first two routes. If you already have both, move to the third and fourth. If a customer, insurer or card processor is asking questions, jump to the final route, because they will usually want evidence of a structured approach.
The attacks worth planning around
Three attack types explain most of the baseline: ransomware, phishing and denial-of-service floods. Each one maps to a specific control, which is why the baseline looks the way it does.
- Ransomware. COSE describes it as malicious software that encrypts data and demands payment for its release. The impact is loss of access to your own files, so the defence that matters most is a backup you can restore from without paying.
- Phishing. The same COSE guide defines phishing as deceptive emails designed to steal credentials or distribute malware. Impact depends on what the victim can reach, which is why multi-factor authentication and limited access both matter.
- Denial-of-service floods. Rightworks lists distributed denial-of-service attacks as botnet traffic that overwhelms a server, with downtime and lost revenue as the result. This matters most if customers reach you through a website or server you operate.
The NIST Computer Security Resource Center indexes its published cybersecurity documents by topic, and phishing, ransomware and vulnerabilities each have their own tags. A publicly maintained topic index like this is a reasonable place to look when you want authoritative guidance on one specific threat.
Email-borne attacks
Phishing is the entry point for many other incidents, so it earns early attention. For a practical walkthrough of warning signs, read how to spot a phishing email. Phishing is one form of manipulation among several, and social engineering attacks examples shows how the same tricks arrive by phone, text and in person. When the goal is redirecting a payment, the pattern is covered in Business Email Compromise: What It Is, How It Works, and How to Stop It in 2026 – Hardcarsecurity.
Choosing what to worry about first
A business that sends invoices by email and stores everything in a cloud drive faces credential theft and ransomware more than a flood of traffic. A business that takes bookings through its own website has a stronger reason to think about availability. Match the threat to how you actually earn money, then spend effort on the matching control rather than trying to cover every possibility at once.
Accounts and multi-factor authentication
Multi-factor authentication is the best first move for a business without a security team, because it costs little and protects the accounts attackers value most. The AO Fund guide explains that two-factor authentication adds an extra layer by requiring a second form of verification, such as a text message, an authenticator app or a hardware key. A stolen password alone is then not enough to sign in.
Should you enable it? Yes. The same guide advises enabling it on all business-critical accounts, such as email and financial platforms, and Rightworks goes further, recommending multifactor authentication for all accounts that support it. A sensible order is email first, because email resets other passwords, then banking and payment platforms, then everything else that offers the option.
Choosing a second factor
- Text message codes. They are the easiest to roll out because staff already have phones, so they suit a firm that needs coverage quickly.
- Authenticator apps. They suit most small teams once the initial push is done, since they do not depend on a phone signal.
- Hardware keys. They suit the accounts whose loss would hurt most, such as the owner’s email and the banking login, and they are worth considering for administrators.
The supplied guidance names these three forms of second factor but does not rank them. Treat any second factor as far better than none, and move individual accounts to a stronger type as you gain confidence.
Passwords and who can reach what
Multi-factor authentication works alongside good password habits, not instead of them. A shared tool for storing and generating passwords makes unique credentials practical, and best password manager for small business covers features, costs and rollout. Rightworks also recommends the principle of least privilege, meaning employees can access only what they need. In practice that means a bookkeeper does not need administrator rights on the whole network, and a departing employee’s access is easy to remove because it was narrow to begin with.
If your insurer asks about authentication, MFA Requirements For Cyber Insurance: How To Qualify And Reduce Your Risk In 2026 – Hardcarsecurity explains how the requirement tends to work and what to prepare.
Backups and ransomware recovery
To protect a business from ransomware, make sure a clean copy of your data exists somewhere the attacker cannot reach. Rightworks notes that when you back up data off-site through a partner that specialises in protecting critical information, the impact of ransomware is neutralised, because you can recover without paying. That is the strongest practical answer in the supplied guidance, and it is why backups sit near the top of the order of work.
The 3-2-1 rule
COSE recommends the 3-2-1 backup rule: three copies of your data, on two different storage types, with one copy offsite. Each part answers a different failure. Several copies guard against a single bad file or device. Different storage types guard against one kind of media failing. The off-site copy guards against fire, theft or an attacker who reaches everything on your local network.
How often to back up and test
No single schedule fits every business, and the supplied guidance gives no fixed interval for taking backups. A workable rule is to ask how much recent work you could afford to redo and set the schedule so you never lose more than that. A business that writes invoices all day has a shorter tolerance than one that updates a price list occasionally.
Testing matters as much as frequency. COSE advises regularly testing backups to ensure recoverability, and it gives no interval either. Pick a recurring calendar reminder you will actually keep, restore a real file or folder each time, and note who did it. A backup that has never been restored is an assumption, not a safeguard.
Backup versus data leakage
Backups protect against loss. They do not stop information leaving the business. If your concern is staff accidentally sending sensitive files outside the company, Data Loss Prevention Tools: How To Choose, Deploy, And Prove Value In 2026 – Hardcarsecurity covers that separate problem. For businesses that keep files in online storage, cloud security for small business looks at the settings that prevent accidental exposure.
Firewall and endpoint protection
A firewall and endpoint protection cover two different places: the connection to the internet and the devices people actually use. Insurica advises using a firewall for your internet connection, and installing, using and regularly updating antivirus and antispyware software on every computer used in the business. Both belong in the baseline, and neither is a substitute for the other.
Firewall decisions
For a small office, the practical decision is whether to rely on the equipment the internet provider supplies or to buy a dedicated device. The evidence supplied here supports the principle of having a firewall on the connection rather than ranking products. If you are comparing devices and subscriptions, best firewall for small business is the place to weigh needs against cost.
Endpoint protection decisions
COSE says endpoint monitoring should use real-time detection, with virus protection active at a minimum. Read that as a floor. Every laptop, desktop and server should have protection that is switched on and updating, and personal devices used for work belong in the same count. Gaps tend to appear on the machine nobody remembers, such as a spare laptop or a back-office PC, so keep a simple list of every device and tick each one off.
Comparing protection tiers
Small businesses can reach a reasonable baseline without a large budget, but the tiers differ in robustness. The table compares the options the supplied guidance mentions, and the planning column turns each into a decision. Pricing figures are not given in the supplied guidance, so the comparison uses relative cost tiers rather than amounts.
| Option | Cost tier | What it offers | Planning use |
|---|---|---|---|
| Free antivirus such as Avast or Bitdefender | Free | Some protection, but less robust than paid tools | Acceptable stopgap for a very small firm; plan to move up as the business holds more customer data |
| Low-cost trusted security software such as Norton or McAfee | Low cost | Covers small firewall and antivirus needs | Sensible default for a business with a few devices and no IT staff |
| Off-site backup through a specialist partner | Paid service | Off-site copy you can recover without paying a ransom | Best value against ransomware, so budget for it before extra security tools |
These tiers draw on the AO Fund guide, which describes the free and low-cost software options, and on Rightworks, which describes the off-site backup partner approach.
Reading the table
Free tools are a fair start, and the AO Fund guide says plainly that they still offer some protection. They suit a sole trader with a couple of devices. Once several people share files, or customer records are involved, the low-cost paid tier is the better default. Whatever you choose, make sure it is installed on every machine and updating automatically, because an unmanaged premium product protects less than a managed basic one.
People, training and everyday habits
Technical controls fail when people are not prepared, so training is the habit that makes the rest hold. Rightworks recommends simulated phishing tests to identify vulnerable employees. Used well, a test is a way to see where extra coaching is needed, not a way to blame staff, and repeating it keeps the lesson fresh.
Budgeting for training is straightforward once you know the models. How Much Does Security Awareness Training Cost in 2026? Real Average Prices, Models, and a Practical Budget Guide – Hardcarsecurity compares what businesses typically pay. When you are ready to build something ongoing rather than a one-off session, Cybersecurity Awareness Training Programs: Build A Practical, High-Impact Program For 2026 – Hardcarsecurity covers programme design.
Habits that cost nothing
- Verify unusual requests. A payment change or urgent request should be confirmed through a channel you already trust, not by replying to the message.
- Report quickly. Make it normal to say a message looked wrong, so the first person to notice is not the last to hear.
- Remove access at exit. Narrow permissions make it quick to close accounts when someone leaves.
Frameworks, risk assessment and outside help
Once the baseline is running, a framework turns a list of good ideas into something you can measure. COSE advises small businesses to follow security frameworks such as NIST, CIS Controls and ISO 27001 where relevant and proportional. The word proportional matters: a small firm should borrow the parts of a framework that fit its size rather than attempt a full compliance exercise. The NIST Computer Security Resource Center lists a cybersecurity framework topic alongside its current list of final and draft publications, so that is where to find the official documents.
Free planning help
If you want a structured plan without paying for a consultant, Insurica points to a tool from the Federal Communications Commission for small businesses, an online planner at fcc.gov/cyberplanner. It suits an owner who wants to record decisions on paper before talking to an adviser.
Assessing and testing
A written risk assessment is the logical next step after the baseline, and the Cybersecurity Risk Assessment Checklist: A Practical 2026 Guide To Finding And Fixing Vulnerabilities – Hardcarsecurity shows how to run one. Outside testing comes later. To understand which type of testing fits your situation, read Vulnerability Assessment Vs Penetration Testing: What’s The Difference And Which One To Use In 2026 – Hardcarsecurity, and to plan a budget, see How Much Does Penetration Testing Cost? A Practical Pricing Guide For 2026 – Hardcarsecurity. Wait on testing until the baseline controls are in place, because a test is more useful when it probes a defended environment than when it lists the basics you already know are missing.
Compliance and managed help
If you accept card payments, your processor may impose its own security rules, and pci compliance for small business explains what you must do. If keeping up with all of this is beyond the hours you have, outside providers can take on part of the load, and msp vs mssp explains how general IT support differs from dedicated security services.
A sensible order of work
Put together, the ranking reads as a short list of decisions. Enable multi-factor authentication on email and finance accounts first. Set up the 3-2-1 backup rule and test a restore next. Check that every device has active protection and that the internet connection has a firewall. Train staff and narrow access, then adopt a proportionate framework and assess risk on paper. Each step reduces a specific harm described earlier, and none needs a dedicated security employee to start.
Frequently asked questions
| Question | Answer |
|---|---|
| Is free antivirus enough for a small business? | It gives some protection but is less robust than paid tools, according to the AO Fund guide. It can serve as a stopgap for a very small firm; a low-cost paid product is the safer default as more data and people are involved. |
| Which security framework should a small business follow? | COSE names NIST, CIS Controls and ISO 27001 and advises using them where relevant and proportional. NIST publishes its documents through its Computer Security Resource Center, which is a practical starting point. |
| Is there a free tool to help plan small business security? | Yes. Insurica points to an online cyber planner from the Federal Communications Commission at fcc.gov/cyberplanner, built for small businesses. |
| Do I need to test backups if I already have off-site copies? | Yes. COSE advises regularly testing backups to ensure recoverability, because an untested copy may not restore when needed. |
