The most effective cybersecurity steps for a small business are not expensive: turn on multi-factor authentication for every account, keep software and devices updated, back up critical data offline and test restoring it, train staff to spot phishing, use a password manager, limit admin access and have a written plan for what to do if you are hit. These basics block most of the attacks small businesses actually face, especially ransomware, stolen passwords and phishing.
Small businesses are not too small to be targeted. Verizon’s 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and medium-sized businesses, compared with 39% at large organizations, and found a human element, such as a clicked phishing link or reused password, in about 60% of breaches overall. The same report found third-party involvement in breaches doubled, to about 30%.
This checklist covers the controls that matter most, in priority order, so you can work through it even without a dedicated IT team.
3-2-1 backups: three copies, on two types of storage, one offsite and offline or immutable
Backups of cloud apps such as email and file storage, not just local machines
A restore test at least every quarter
Sensitive data identified, minimized and stored only where needed
Email and web
SPF, DKIM and DMARC configured for your domain (see our guide on email deliverability for setup details)
External email warning banners turned on
Website and content management system updated, with plugins kept to a minimum
Website admin logins protected with MFA
People and process
Phishing training at onboarding and refreshed at least twice a year
A simple way for staff to report suspicious messages, and thanks when they do
Payment and bank detail changes verified by phone using a known number
Clear rules for using personal devices and AI tools with company data
Vendors
A list of vendors with access to your systems or data
Security questions in contracts for vendors handling sensitive data
Vendor access limited to what they need and reviewed regularly
Planning and insurance
A one-page incident response plan with contacts and first steps
Cyber insurance reviewed, including what controls the insurer requires
Industry or contract requirements identified, such as PCI DSS for card payments, HIPAA for health data or CMMC for US defense contractors
How Do You Protect A Small Business From Ransomware?
Ransomware is the threat most likely to put a small business out of action. The core defenses:
Offline or immutable backups that ransomware cannot encrypt, tested regularly.
MFA everywhere, especially on email and remote access, because stolen credentials are a leading way in.
Fast patching, particularly of internet-facing systems such as VPNs, firewalls and remote access tools.
Least privilege so a single compromised account cannot reach everything.
Endpoint detection that can spot and stop encryption behavior early.
How Do You Stop Phishing And Business Email Compromise?
Business email compromise, where attackers impersonate a supplier or executive to redirect payments, causes large losses for small firms. Protect against it by:
Verifying every change to bank details or urgent payment request by phone, using a number you already have
Requiring two people to approve payments above a set amount
Training staff on the signs: urgency, secrecy, new bank details and slightly misspelled domains
Turning on MFA so stolen passwords cannot be used to read or send email from your accounts
What Should Your Incident Response Plan Include?
Section
What To Write Down
Contacts
Who leads the response, IT support, insurer, lawyer and bank, with phone numbers stored offline
First steps
Disconnect affected devices from the network, do not wipe them, change passwords from a clean device
Communication
Who tells staff, customers and partners, and what not to say publicly before you know the facts
Legal duties
Breach notification rules that apply to you and when to contact law enforcement
Recovery
How to restore from backups and in what order to bring systems back
Review
A short post-incident review to fix the cause
When Should You Hire Outside Help?
Consider a managed IT or security provider when nobody on staff owns security, when you handle sensitive customer, health or payment data, when insurers or clients require specific controls, or when you need 24/7 monitoring. Our lists of top managed IT services providers and top cybersecurity companies are good starting points. Government resources such as CISA in the US and the National Cyber Security Centre in the UK also publish free small business guidance.
Frequently Asked Questions
What is the single most important cybersecurity step for a small business?
Turning on multi-factor authentication, starting with email and financial accounts. It blocks a large share of attacks that rely on stolen or guessed passwords.
Do small businesses really get targeted?
Yes. Attackers often use automated tools that scan for weak spots regardless of company size, and Verizon’s 2025 report found ransomware in the large majority of breaches involving small and medium-sized businesses.
How much should a small business spend on cybersecurity?
There is no fixed figure. Many of the highest-impact controls, such as MFA, updates and training, cost little. Spend more as your data sensitivity, regulatory obligations and dependence on IT grow.
Is cyber insurance worth it?
For many businesses, yes, but it is not a substitute for security. Insurers increasingly require controls such as MFA and backups before they will issue or pay out on a policy.
The Short Version
Turn on MFA everywhere, keep everything updated, back up data with one copy offline and test restores, give every employee a password manager and phishing training, remove everyday admin rights and write a one-page incident plan. These steps stop most attacks small businesses face, and they cost far less than recovering from ransomware.
