Small does not mean unnoticed
Many owners assume attackers only go after large companies. In practice, automated scams and mass phishing campaigns do not choose targets by size. They look for easy openings: reused passwords, unpatched software, unprotected accounts and staff who can be rushed into paying a fake bill. A small business may also have fewer safeguards and less time to recover from a problem.
The good news is that a handful of inexpensive habits covers a large share of everyday risk. This guide focuses on four areas: who can access what, backups, accounts held with vendors and a basic plan for incidents. It is general information, not professional advice, and no set of measures removes risk entirely.
Start with a simple inventory
You cannot protect what you have not listed. Spend an hour writing down:
- Accounts: email, accounting software, payment processors, banking, website hosting, domain registration, social media and any cloud storage.
- Devices: laptops, phones, tablets, point-of-sale equipment and the office router.
- Data: customer details, employee records, financial files and anything you would struggle to replace.
- People: employees, contractors and outside providers who can reach any of the above.
Keep this list somewhere secure and update it when something changes. It becomes the backbone for everything else here.
Access control: the right people, the right level
Access control means that each person can reach what their job requires and nothing more.
- Give everyone their own login. Shared accounts make it impossible to tell who did what and hard to remove one person’s access. Where sharing is unavoidable, a password manager with sharing features is safer than passing credentials around in chat or email, and the ideas in shared account access apply directly.
- Limit administrator rights. Day-to-day work rarely needs full admin powers. Keep a small number of admin accounts and use ordinary accounts for routine tasks.
- Turn on two-step sign-in for email, banking, accounting and any tool holding customer data. If your email account is taken over, an attacker can often reset the passwords for everything else.
- Use unique passwords. The risks of password reuse are especially sharp for a business, because one leaked password can unlock several systems. Password managers make unique passwords realistic for a whole team.
- Remove access promptly. When someone leaves or a contractor finishes a project, disable their accounts the same day and change any shared passwords they knew.
Backups: your safety net
Backups are what let a business keep operating after a mistake, a hardware failure or a ransomware incident. A few principles help:
- Back up the data you cannot recreate, such as accounting records, customer files and documents.
- Keep at least one copy separate from the computers it protects. A backup that is always connected can be damaged by the same attack. The 3-2-1 backup rule, which keeps several copies on different kinds of storage with one kept elsewhere, is a common way to think about this.
- Test restoring a few files from time to time. A backup that has never been tested may fail when it is needed.
- If backups contain customer or employee data, consider backup encryption so a lost drive does not become a data leak.
For businesses worried about extortion attacks, working backup ransomware recovery is often the difference between restoring operations and facing a very difficult decision.
Vendor and third-party accounts
Your business probably depends on outside services: payment processors, website platforms, accountants, marketing tools and an IT contractor. Each is a possible way in.
- Know who has access. Review which vendors can log in to your systems and what they can see.
- Prefer separate logins for outsiders. Avoid giving contractors your own credentials. Individual accounts can be switched off without disturbing anyone else.
- Keep the keys to critical accounts. Domain registration and website hosting accounts should be in the owner’s name, with an email address the business controls. Owners sometimes discover too late that a former web designer holds the only login.
- Review connected apps now and then, and remove ones you no longer use.
Staff habits that prevent costly mistakes
For most small businesses, money is lost through convincing messages rather than clever hacking. Fake invoices, changed bank details and urgent requests that appear to come from the owner are common patterns, covered further under invoice fraud and executive impersonation emails.
A simple rule helps: any request to change payment details or send money urgently gets confirmed by a phone call to a number you already have, not one in the message. Make it clear to staff that checking is welcome, even when the request appears to come from you. A few minutes of explanation, repeated now and then, goes a long way.
A one-page incident plan
When something goes wrong, stress makes decisions harder. A short written plan, kept somewhere you can reach even if your systems are down, might include:
- Who decides. Name one person in charge and a backup.
- First steps. Disconnect affected devices from the network, avoid deleting evidence, and change passwords for affected accounts from a clean device.
- Contacts. Your bank, your IT provider, your insurer if you have a cyber policy, and your local law enforcement or national fraud-reporting service.
- Customers and staff. Who tells them, and what they are told. Some places have legal duties to report certain data breaches, so ask a qualified advisor in your area.
- Recovery. Where the backups are and who can restore them.
Where to start if time is short
If this feels like a lot, pick three actions for this week: turn on two-step sign-in for email and banking, confirm that a recent backup exists and can be restored, and write the one-page incident plan. Then add the rest gradually. Steady, modest improvements usually protect a small business better than a big effort that is never finished.