Most data breaches at small businesses don't start with a genius hacker. They start with a reused password, a missed update or a convincing email. These ten steps close the doors attackers use most often.
1. Turn on two-step sign-in everywhere
Two-step sign-in (also called multi-factor authentication or MFA) means a stolen password alone isn't enough to get in. Start with email, then your accounting software, banking, remote access and any admin accounts. It blocks the large majority of account takeovers.
2. Keep everything updated
Updates close security holes that attackers already know how to use. Turn on automatic updates for computers, phones and browsers, and don't forget the network gear: firewalls, routers and Wi-Fi access points need updates too. Replace anything that no longer gets them.
3. Use strong, unique passwords
When one site leaks a password, attackers try it everywhere else. A password manager makes it practical to use a long, different password for every account. Make sure nobody shares one login between several people.
4. Train your team to spot scams
Phishing emails, fake invoices and urgent "can you do me a favor" messages are how most breaches begin. Short, regular training with practice emails works far better than a once-a-year slideshow. Make it easy and blame-free for staff to report something odd. Our free phishing quiz is a good place to start.
5. Give people only the access they need
Not everyone needs access to payroll, client files or the admin settings. Limit access by role, keep admin accounts separate from everyday ones, and review who has access to what at least once a year.
6. Close accounts the day someone leaves
Former employees' accounts are an easy way in, and nobody notices when they're used. When someone leaves, turn off their sign-in, change shared passwords they knew, and collect company devices on their last day.
7. Back up your data and test it
Backups won't stop a breach, but they decide whether ransomware is an inconvenience or a disaster. Keep at least one copy offsite and out of reach of your everyday network, and test a restore regularly. Try our free backup check to see where you stand.
8. Protect every computer and watch for trouble
Modern endpoint protection does more than old-style antivirus: it spots suspicious behavior and can isolate a computer before an attack spreads. Pair it with monitoring so someone actually sees the alerts, including at night and on weekends.
9. Lock down email
Set up your domain's email security records (SPF, DKIM and DMARC) so criminals can't easily send email that looks like it came from you. Our free email security check grades your domain in a few seconds.
10. Have a plan before you need it
Write down who to call, how to cut off access and how to reach clients if something happens. Check whether your industry or state has rules about reporting a breach, and whether your cyber insurance has its own steps you must follow. A one-page plan beats figuring it out in a panic.
Where to start
If this list feels like a lot, start with steps 1, 2 and 7: two-step sign-in, updates and tested backups stop or soften most attacks. A security risk assessment can show which of the rest matter most for your business.
