Small business cybersecurity basics that stop most attacks

Public guidance from NIST and CISA for small organizations keeps coming back to the same core steps. They cost little and close the most common ways in.

1. Turn on multi-factor authentication

Require a second step, such as an app or a security key, for email, banking, payroll, cloud storage and any admin account. Stolen passwords alone then stop working.

2. Use strong, unique passwords

A password manager lets each person keep a different long password for every account. Never reuse passwords across work and personal accounts.

3. Keep everything updated

Turn on automatic updates for computers, phones, browsers and business software. Replace devices that no longer receive security updates.

4. Back up and test

Back up important data regularly, keep at least one copy separate from your main network, and test a restore. Backups are your way back from ransomware.

5. Teach people to spot phishing

Most attacks start with an email, text or call that pressures someone to click, pay or share a code. Teach staff to slow down and verify unusual requests by calling a known number.

6. Limit access

Give each person only the access they need. Remove access the day someone leaves. Keep administrator rights to a few people.

7. Plan for a bad day

Write down who to call, how to reach them and what to disconnect if something goes wrong. Keep the list on paper too.

Score yourself with the security checkup.