Learn / Small business security
Security basics for small businesses: the top 10 controls
Ten controls that stop most attacks on small teams, ranked by impact, with what each one costs in time and money.
Why small businesses are targets
Most attacks on small companies are not personal. Criminals run automated campaigns that try stolen passwords against email logins, scan the internet for unpatched devices, and send invoice scams to thousands of addresses at once. A five-person accounting office and a 500-person retailer look the same to a script. What makes a business a victim is usually one gap: no multi-factor login, an old router, or a habit of paying invoices on email instructions alone.
You do not need an enterprise budget to close those gaps. The ten controls below reflect the common themes in government small-business guidance (such as the FTC's small business pages and CISA's Cyber Essentials) and what incident responders see again and again.
The top 10 controls, in order
- Multi-factor authentication (MFA) on email and admin accounts. Email is the master key to everything else, because password resets land there. Turn on MFA for every mailbox, your domain registrar, banking, payroll and cloud admin consoles. Prefer an authenticator app, passkey or hardware key over text messages. See two-factor and passkeys.
- A password manager for the whole team. Unique passwords stop one leaked login from opening ten doors. Business plans let you share vault items without pasting passwords into chat. Our password manager comparison covers the options.
- Automatic updates everywhere. Turn on automatic updates for operating systems, browsers, office software, phones and especially routers, firewalls and VPN appliances. Edge devices are a favorite target because they face the internet.
- Backups you have actually restored. Keep at least one copy offline or immutable so ransomware cannot encrypt it. Details in backups and ransomware readiness.
- A payment verification rule. Any new or changed bank details must be confirmed by phone, using a number you already had, never the one in the email. This single rule defeats most business email compromise.
- Least privilege. Staff use normal accounts day to day; admin rights live in separate accounts used only when needed.
- Fast offboarding. Disable accounts the same day someone leaves. See access control and offboarding.
- Phishing awareness. Short, regular training plus an easy way to report suspicious messages. See employee phishing training.
- Device basics. Full-disk encryption (BitLocker or FileVault), screen locks, built-in antivirus switched on, and the ability to wipe a lost laptop or phone remotely.
- A one-page incident plan. Who to call, how to isolate a machine, where backups live. See incident response for small teams.
Effort versus impact
| Control | Typical cost | Setup time | Impact |
|---|---|---|---|
| MFA on email and admin | Usually free | An afternoon | Very high |
| Password manager | Low monthly per user | A day to roll out | High |
| Automatic updates | Free | An hour plus checks | High |
| Tested offline backups | Low to moderate | A day, then monthly tests | Very high for ransomware |
| Payment verification rule | Free | One meeting | Very high for invoice fraud |
| Least privilege | Free | A few hours | Medium to high |
| Same-day offboarding | Free | A checklist | Medium |
| Phishing training | Free to low | Minutes a month | Medium |
| Device encryption and wipe | Usually built in | A few hours | Medium |
| Incident plan | Free | Two hours | High when it matters |
Where to start this week
If you only do three things, do these: turn on MFA for every email account, write down and enforce the payment verification rule, and confirm that a backup exists that a compromised laptop cannot reach. Those three steps address the most common ways small firms lose money.
Next, make a simple inventory: a spreadsheet of every device, every cloud service, who has admin access to each, and when it was last updated. You cannot protect what you do not know you have, and the inventory makes offboarding and incident response far faster.
Put security on the calendar. A 15-minute monthly check (are updates current, did last night's backup run, has anyone left) catches drift before it becomes an incident.
What not to spend money on first
Small businesses are often sold expensive tools before the basics are in place. A next-generation firewall does not help if the owner's mailbox has no MFA. Cyber insurance is worth considering, but insurers commonly ask whether you have MFA, backups and endpoint protection before they will quote, so the basics come first either way. Get the ten controls above working, then look at managed detection, insurance or outside audits.
Free resources worth bookmarking
- The FTC's small business cybersecurity pages, written for non-technical owners.
- CISA's Cyber Essentials and its free services for small organizations.
- Your email platform's own security checklist (Microsoft 365 and Google Workspace both publish one), which walks through MFA, external-sender banners and audit logging for your exact setup.
