Small business cybersecurity basics

Most cybersecurity advice is written for companies with a security team. This section is for everyone else: the bakery, the dental office, the five-person agency, the contractor running the business from a laptop and a phone.

You don't need to be perfect. Cover the basics that stop the most common problems, then keep them up.

What does cybersecurity look like for a small business?

For a small business, cybersecurity is mostly about protecting a few things: your accounts, your devices, your data, and your public presence online (your website and email domain). Each has a small set of habits that make a big difference.

CISA's Cyber Essentials frames it as a leadership task as well as a technical one. As the owner, you decide what matters most and make sure it gets done.

What are the most important basics?

If you only do a few things this month, make it these:

• Turn on two-step sign-in (MFA) for email, banking, payroll and your website admin.
• Turn on automatic updates for computers, phones and website software.
• Back up important files automatically, and keep one copy offline or separate from your main account.
• Use a password manager so every account has a unique password.
• Set up email authentication so scammers can't easily send mail as your business.

Our small business cybersecurity checklist turns these into a step-by-step list you can work through over a few weeks.

How do I figure out where my business is exposed?

A simple risk assessment helps you focus. List what you'd least like to lose or have leaked, like client records, payment details or access to your email. Then note where each lives and who can reach it.

Our guide to a small business cybersecurity risk assessment walks you through this in plain English, with no spreadsheets full of jargon. For the parts anyone can see from outside, the free website security scan checks your website, domain and email setup in one pass.

What are the most common threats?

Most incidents at small businesses start with something ordinary. A phishing email gets someone to enter a password on a fake login page. A business email compromise scam asks your bookkeeper to update a supplier's bank details. Ransomware locks files until a payment is made.

The basics above reduce the risk of all three. Backups make ransomware far less damaging, and a quick phone call to confirm any payment change stops many email scams.

Where can I get more help?

You don't have to figure this out alone. NIST's Small Business Cybersecurity Corner collects free guides and lists support programs, and its CSF 2.0 Small Business Quick-Start Guide is a short, practical starting point. The FTC's Cybersecurity for Small Business pages cover topics including vendor security and cyber insurance.

When you're ready, read our guides on website security and email security, then run a free scan to see where you stand today.