Picture this: it’s a Tuesday morning, someone opens what looks like an invoice email from a regular vendor, and by lunchtime the business’s bank account is $40,000 lighter. No dramatic hacker-in-a-hoodie moment. No warning siren. Just one click.

That’s the uncomfortable truth about small business cybercrime: it rarely looks like the movies. It looks ordinary, which is exactly why it works.

The good news? You don’t need a cybersecurity degree or a six-figure IT budget to dramatically cut your risk. You need a handful of good habits, done consistently, plus a plan for who to call when something goes sideways.

The Cheat Sheet

If you read nothing else, read this:

• Know what you’d miss if it disappeared — map your critical systems and data
• Hoard less data — only keep what you actually need
• Lock the front door twice — multifactor authentication (MFA) everywhere it’s offered
• Kill password reuse — a password manager makes this painless
• Patch fast — updates close the doors attackers already know about
• Train people to pause — phishing succeeds by rushing people
• Back up like you mean it — and actually test the restore
• Give access on a need-to-know basis — for employees and vendors alike
• Check your insurance — a general policy may not cover a cyber incident
• Write the plan before you need it — improvising during a crisis is expensive
• Know your emergency contacts in advance — IT, insurer, bank, and any specialists you’d call

Now let’s dig into each one.

Step One: You Can’t Protect What You Haven’t Mapped

Most businesses have a rough mental model of their tech — a laptop here, a POS system there, “the cloud” somewhere. That’s not enough. Before you can defend anything, you need an actual inventory:

• Computers, phones, servers, network gear
• Email, accounting, payroll, point-of-sale, and cloud tools
• Customer, employee, payment, health, and tax records
• Websites, social accounts, domain registrations
• Any vendor with a key to your systems or data

For each item, assign an owner — even if that “owner” is an outside IT provider. A system nobody’s watching is a system nobody notices when it breaks.

Helpful Tip: The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide is a useful resource for businesses that are not sure where to begin.

The Insurance Policy You Probably Haven’t Reread

Here’s a surprisingly common assumption: “We have business insurance, so we’re covered.” Cyber incidents are often a different category entirely, with their own exclusions, deadlines, and requirements about which vendors you’re allowed to use during a response.

Pull out your policy. Not to become an expert in it, but to know the shape of it: what’s covered, what isn’t, how fast you need to report a claim, and whether the insurer has approved responders they expect you to use. Then keep the insurer’s emergency number taped right next to your incident plan.

Digital Decluttering: Keep Less, Risk Less

Every record you store is a small liability sitting on a shelf. Periodically ask, for each category of data you hold:

Think of it as spring cleaning for your data closet.

Passwords: The Weakest Link, Made Strong

Stolen credentials remain one of the most common ways into a business. Two fixes do most of the heavy lifting:

1. A password manager. Long, unique passwords for every account, with zero mental effort required to remember them.

2. Multifactor authentication (MFA). Turn it on everywhere — email, banking, payroll, cloud storage, remote access, and especially admin accounts. An authenticator app or hardware security key beats a text-message code.

And when someone leaves the company or changes roles? Cut their access immediately, not “whenever we get to it.”

Updates: Boring, But It’s the Whole Game

A huge share of successful attacks exploit a vulnerability that was already fixed — the victim just hadn’t installed the patch yet. Turn on automatic updates for operating systems, browsers, apps, security software, and network hardware. Retire anything that no longer receives security updates; an unsupported device is a standing invitation.

For Wi-Fi: use WPA2 or WPA3 encryption, set a strong admin password, and keep guest devices on a separate network from your business systems.

Train People to Slow Down for Ten Seconds

Most attacks start with a message: an email, a text, a phone call, a fake login page. The goal is almost always urgency — “act now or something bad happens.” Training that works focuses on pausing, not memorizing threat categories. Employees should know how to:

• Check the full sender address, not just the display name
• Treat unexpected links, attachments, and login prompts with suspicion
• Report anything odd without fear of getting in trouble
• Reject MFA prompts they didn’t request
• Report lost devices or accidental disclosures right away
• Confirm any payment or bank-account change through a second channel

That last one deserves its own spotlight: if a vendor emails new payment instructions, call them back using a number you already had on file — never the number in the email itself. This single habit stops a huge share of business email compromise scams.

Access: Nobody Needs a Master Key

Give employees and vendors access to exactly what they need — no more. Individual logins instead of shared ones, admin rights reserved for the people who truly need them, and periodic access reviews so old permissions don’t quietly pile up.

Before handing a vendor sensitive information, it’s worth asking how they protect it: encryption, access controls, MFA, patching habits, backups, incident detection, and what happens to your data when the relationship ends. Outsourcing work doesn’t outsource the risk.

Backups: Your Insurance Policy’s Insurance Policy

A tested backup is often the single biggest difference between “we lost an afternoon” and “we lost the business.” Back up essential data regularly, and keep at least one copy separated from your everyday systems so an attack that reaches your main network can’t reach the backup too.

Then — this part gets skipped constantly — actually test that the backup restores. A backup you’ve never tried to recover from is a hope, not a plan.

CISA’s small and medium business resources are a solid reference for backups, encryption, and the rest of this list.

Build the Plan Before the Fire

You don’t write a fire escape plan while the building is burning. The same logic applies here. A short, clear incident-response plan should spell out:

• Who leads the response. Put one person in charge of the plan, and name a backup. The lead does not have to do everything. Their job is to assign tasks, coordinate the people involved, and make sure each step gets handled.
• What your insurance requires. Ask how and when to report an incident, whether you need approval before hiring outside help, and whether the policy requires certain attorneys, cyber-response firms, or other vendors. Keep the policy number and the insurer’s emergency contact information with the plan.
• Who you will call. Using the insurer’s requirements, build a contact list that includes your attorney, cyber-response or digital forensics firm, IT provider, bank, and other key advisors.
• What your IT provider can do. Do not assume your regular IT company can investigate a cyberattack. Ask what types of incidents it handles, whether help is available after hours, and what it can do without harming evidence. If it does not handle cyber incidents, know which approved provider will.
• How to reach your bank quickly. Save the bank’s fraud number and ask whom to contact about stopping or reversing a transfer.
• How employees report concerns. Give employees a clear way to report anything suspicious, including when email or other systems are unavailable. Decide who will log each report and what action was taken.
• How your backups work. Record where backups are stored, who can access them, and how often they are tested. Keep at least one backup separate from your main network.
• How the business will keep operating. Decide which work must continue and how employees will do it while systems are unavailable.
• Who handles messages. Choose who will handle and approve messages to employees, customers, vendors, or the public. In a small business, this may be the person leading the response.
• How the response will be documented. Decide who will record key events, decisions, contacts, and actions as they happen.

Keep the plan, contact list, and key instructions in print or in another safe place that does not depend on your network. If your systems are locked, a plan stored only on that network will not help you. Walk through the plan at least once a year. Update it after any major change in staff, technology, vendors, banking, or insurance coverage.

If You Suspect Something Is Wrong: A Calm Sequence

Adrenaline makes people do the wrong thing fast. Here is the order that actually helps:

1. Contain it. Disconnect the affected device from the network by unplugging its network cable or turning off its Wi-Fi. Do not unplug its power cord, shut it down, wipe it, or reinstall anything. That “fix it myself” instinct can destroy evidence a specialist may need. Use a different, trusted device to start the call list in your plan.

2. Call your response team. The person leading the response should notify the cyber-insurance carrier using the instructions in the plan. The carrier may require certain attorneys, investigators, or other vendors. Follow its directions for contacting approved providers. Bring in your bank, IT provider, and communications advisor as the situation requires.

3. Preserve everything. Save suspicious emails, alerts, ransom notes, logs, and transaction records. Write down what happened, when it happened, and who took each action. Do not delete anything just because it looks embarrassing or alarming.

4. Protect the money. If a bank account or payment may be at risk, call your financial institution right away. Ask whether it can stop or reverse the transfer. Following your response team’s instructions, change any compromised passwords from a device you trust. You can also report business email scams and fraudulent transfers to the FBI’s Internet Crime Complaint Center.

5. Loop in the right expertise for anything with legal or contractual angles. Requirements here vary a lot by situation and location, so this is a moment to lean on qualified professionals (like us) rather than guess. Different places have different rules about reporting a data breach and notifying the people affected, including customers, employees, and vendors. In some cases, companies must also report the breach to law enforcement and cooperate with the investigation. Contact an attorney with experience in this area to review your obligations to different groups and jurisdictions.

6. Speak with one calm voice. Have one person handle updates for the business. That person should work with your technical and professional advisors so the business shares one clear, accurate message—not five different guesses. Share updates when you can do so safely and accurately. When it is time to notify people, clearly explain what happened, what data was involved, what you are doing about it, what people should do, and where they can find reliable updates.

7. Recover deliberately. Do not reconnect devices, restore data, or bring systems back online until your cyber-response team has finished its investigation and says it is safe. Let the team restore clean backups, change access credentials, install updates, and watch for anything unusual. Then review the response: How did the incident happen? Did the plan work? Were any steps missed or delayed? What should change before the next incident?

Five Things You Could Do Before the Weekend:

Big transformations are nice in theory; small, immediate wins are what actually happen. This week, try:

1. Turn on MFA and automatic updates.
2. Pull out your insurance policy and actually read the cyber section.
3. Confirm your backups exist and that they restore successfully.
4. Write a one-page approval process for payments and banking changes.
5. Draft the skeleton of an incident-response plan with your key contacts listed.

No business gets to zero risk. That’s not the goal. The goal is making an attack less likely to succeed, less damaging if it does, and far easier to recover from. A little preparation now buys you a lot of calm later.