A busy office has plenty to keep track of: customers, invoices, schedules, and the computers that keep it all moving. Security becomes easier to manage when it is part of that routine. These ten practices give a small business a useful starting point and a way to decide what to improve next.
1. Turn on multi-factor authentication
Protect email, banking, administrator accounts, and remote access with multi-factor authentication (MFA). Prefer phishing-resistant options such as security keys or passkeys where supported. Never approve a sign-in prompt you did not initiate; report unexpected prompts to your IT contact.
2. Give every account its own password
Use a business password manager to create and store long, unique passwords. Give employees individual accounts rather than sharing one login. Store recovery information securely so a lost phone or departing employee does not lock the business out.
3. Keep software supported and updated
Track operating systems, browsers, business applications, and network equipment. Enable automatic security updates where practical, and schedule changes that need testing. Include a replacement plan for products that no longer receive security fixes.
4. Make suspicious messages easy to report
Show staff how to report unusual emails, texts, and calls. An urgent request from a familiar name can still be fraudulent. Verify changes to payment instructions using a phone number you already trust, rather than contact details supplied in the message.
5. Protect each business device
Maintain endpoint security, device encryption, and automatic screen locking on business computers. Assign someone to review alerts and respond. A security program that nobody checks leaves an important part of the job unfinished.
6. Limit access to what people need
Review who can access payroll, customer records, and shared folders. Use separate administrator accounts for administrative work. Remove access promptly when a person leaves, and review outside vendors' access as well.
7. Back up data and test a restore
List the information you would need after a failure, including cloud files and application data. Protect backup access separately and retain a copy that an attacker cannot easily alter. Test restoring a file and record what worked.
8. Separate guests from business systems
Offer visitors a separate wireless network. Ask your IT provider whether printers, cameras, and other connected devices should be separated from sensitive business systems. Check that the separation actually restricts access rather than only changing the network name.
9. Write a short incident plan
Document who to call, who can approve emergency decisions, and how staff should report an incident. Keep an accessible copy outside the affected system. A short plan that people understand is more useful than a long document nobody can find.
10. Review progress regularly
Give each improvement an owner and a completion date. Revisit access, backup results, and unresolved security alerts on a regular schedule. Begin with a few important gaps and build from there; security needs ongoing attention as the business changes.
Make a plan for your business.
Tell Summit about your technology and priorities. Our IT needs assessment is a practical place to start.
Start your IT assessment ↗Further reading
Official resources that support the topics discussed here.