Small business cybersecurity: where to start

A small team can start by listing the services that control payments, email, customer information and the website. Record the responsible person and approved recovery method for each. An account left under a former employee’s control can create an operational risk even without a sophisticated attack. Use the inventory to identify missing ownership and access that is broader than a person’s current responsibilities. Do not put passwords in the inventory itself.

Discuss appropriate multifactor authentication, unique credentials and timely updates with your technical support provider. Staff need a reliable way to report suspicious messages without being penalized for asking. Establish a separate verification procedure for payment-detail changes; a familiar-looking email alone should not settle the question. Tailor controls to the systems actually used, and keep a record of actions completed rather than treating a purchased security tool as the entire program.

For a hypothetical retailer, losing access to inventory and order records could prevent fulfillment. Identify a backup and test whether an authorized person can restore usable sample information in a controlled environment. Record what was restored, how long it took and what remained missing. A backup notification proves that a job reported completion; it does not by itself prove the recovery process works. Avoid making destructive changes to live customer records during a test.

Know whom to contact for your hosting, payment, email and IT services. Define who can suspend access, preserve relevant records and communicate with customers. Legal duties following an incident depend on the information and jurisdiction, so seek qualified guidance for the actual event. NIST provides public small-business cybersecurity resources. This owner checklist is a starting point for discussion and verification, not a security certification or assurance that incidents cannot happen.

Ask the responsible person to show completed access changes, a recent update record and the result of a recovery test. Keep unresolved actions visible with due dates. Confirm that former staff no longer have access and that an authorized backup can reach support. Do not rely on an account owner saying everything is secure without explaining the scope of that statement. If specialist work is needed, define the system and the expected evidence in the engagement. Progress should be measured by verified controls, not by the size of a checklist.