Most small business cybersecurity advice is written for companies with an IT department, a budget line and a compliance officer. You have none of those. You have a laptop, a phone, a handful of accounts that run the whole business, and about four hours you could clear on a slow Thursday. That is enough time to close the gaps that attackers actually use.<\/p>\n
This is an operational checklist, not a framework. Work through it in order, because each step makes the next one safer.<\/p>\n
Five things, in this sequence:<\/p>\n
The order matters. Turning on MFA before you have a password manager means your recovery codes end up in a text file on the desktop. Building an incident plan before you know where your backups live means the plan is fiction.<\/p>\n
Do not try to migrate 200 accounts. You will quit at forty. Instead, write a list of your crown jewel accounts<\/strong> \u2014 the ones that can end the business in an afternoon:<\/p>\n That is usually ten to fourteen logins. Install the password manager browser extension and the phone app, import whatever your browser has saved, then go through the crown jewel list one at a time and generate a new random password of twenty characters or more for each. Budget three minutes per account.<\/p>\n Two finishing steps people skip. First, delete the saved passwords from your browser afterward, or you now have two copies of your keys and only one of them is protected. Second, print the password manager recovery kit and put it somewhere physical \u2014 a home safe, a locked drawer. If you forget the master password and the recovery kit is only on the encrypted laptop, you have built a very secure hole in the ground.<\/p>\n You do not need MFA everywhere today. You need it on the accounts that reset other accounts. Work in this order:<\/p>\n Prefer an authenticator app or a hardware security key over SMS codes, because SMS can be intercepted through a carrier account takeover. If a service only offers SMS, take SMS \u2014 it is meaningfully better than nothing.<\/p>\n Enroll two<\/em> second factors on every critical account where the service allows it, for example a hardware key plus an authenticator app on your phone. A single lost phone should never lock you out of your own email. Save every recovery code as a secure note in the password manager as you go, and add a line saying which account it belongs to.<\/p>\n While you are inventorying accounts, note which ones you have connected to third-party AI tools, since those integrations carry their own access. It is worth reviewing what happens to your business data when you paste it into AI tools<\/a> before you widen anyone else’s access to your files.<\/p>\n Cloud sync is not a backup. If a file is corrupted, encrypted by ransomware or deleted, sync faithfully copies that change everywhere. A backup is a copy that a compromised machine cannot reach or overwrite.<\/p>\n The minimum viable setup, in about forty minutes:<\/p>\n Then run the part almost nobody runs. Pick three files that would genuinely hurt to lose \u2014 a signed client contract, last quarter’s books, the source file for your logo \u2014 and restore them to a brand new folder. Open each one. Confirm it is the right version and not corrupt.<\/p>\n Time that restore. If pulling back your working files takes six hours and you cannot afford to be down more than one, your backup design is wrong and you just learned it on a calm day instead of a terrible one.<\/p>\n A laptop stolen from a car is a data breach if the drive is readable, and a lost laptop if it is not. Turn on BitLocker on Windows or FileVault on Mac. Modern phones encrypt by default, but only if you set a passcode \u2014 use six digits at minimum, alphanumeric if you can stand it.<\/p>\n Three details that decide whether this works:<\/p>\n Write down what you do if a device disappears: remote wipe it, then change the password on every account that was signed in on it, starting with email. That sequence belongs on the one-page plan below.<\/p>\n Under stress you will not improvise well. One page, printed, is enough. Put on it:<\/p>\n Print it. If your accounts are locked or your machine is off, a plan living in a cloud document is a plan you cannot open. Keep one copy at your desk and one somewhere off-site.<\/p>\n If you would rather fill in blanks than write from scratch, the Small Business Cyber Readiness & Incident Binder<\/a> is a 16-page binder with an 8-sheet incident workbook and 15 response templates covering the notification and communication drafts described above.<\/p>\n Then add a recurring thirty-minute quarterly block: re-run one restore test, remove accounts for anyone who left, and check that no crown jewel account has quietly lost its MFA setting during a platform migration. Small business cybersecurity fails far more often through drift than through a clever attack.<\/p>\n If the incident plan is the part you keep postponing, start there \u2014 the binder above gives you the templates and the workbook to fill in, and the rest of the Cursiqa workbook library<\/a> covers the neighboring operational systems if you want to keep the momentum going after this afternoon.<\/p>",
"protected": false
},
"excerpt": {
"rendered": " Five security moves you can finish in a single afternoon: a password manager rollout, MFA where it matters, an offline backup you have restored from, device encryption, and a one-page incident plan.<\/p>",
"protected": false
},
"author": 1,
"featured_media": 0,
"comment_status": "open",
"ping_status": "open",
"sticky": false,
"template": "",
"format": "standard",
"meta": {
"_jetpack_memberships_contains_paid_content": false,
"footnotes": ""
},
"categories": [
33
],
"tags": [
84,
83
],
"class_list": [
"post-357",
"post",
"type-post",
"status-publish",
"format-standard",
"hentry",
"category-business-productivity",
"tag-incident-response",
"tag-small-business-cybersecurity"
],
"aioseo_notices": [],
"aioseo_head": "\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
Turn On MFA Where It Actually Stops an Attack<\/h2>\n
\n
Build One Offline Backup, Then Restore From It<\/h2>\n
\n
Encrypt Every Device That Leaves Your Desk<\/h2>\n
\n
Write the One-Page Plan for the Bad Day<\/h2>\n
\n
A Realistic Afternoon Schedule<\/h2>\n
\n