Ask a business owner how secure their company is and you get one of two answers. Either they think they are covered because they bought a security product, or they do not want to think about security at all because it feels like a rabbit hole. Both are reasonable positions. Neither is a plan.
I started out in technical support and moved into consulting because of what I kept seeing: companies buying technology they did not understand, and support that only showed up after something broke. When we look at a small business a few patterns come up over and over. The tools bought last year are running and generating alerts nobody reads. Firewall rules set up two years ago are still open. A contractor account from a finished project is still active. This list is about those patterns. It is the order I would tell a 10-to-200-person company to fix them in.
01 Step one
Turn on multi-factor authentication
If you only do one thing from this article, do this one. Multi-factor authentication (MFA) means logging in needs a password plus something else: a code on a phone, an app prompt, or a hardware key. A password alone can be copied and used anywhere. With MFA, a stolen password is not enough to get in.
Prioritise these, in this order:
- Email. Nobody can reset every other password if they do not own your email first.
- Banking, payment, and accounting systems.
- Remote access: VPN, servers, cloud consoles.
- Anything holding customer or patient data.
Microsoft 365, Google Workspace, most banks, and payroll providers all support MFA. It takes minutes per system and it is mostly one-time setup. This step costs nothing and does the most.
02 Step two
Write down what you actually have
You cannot prioritise anything else in this article unless you can answer a basic question first: what systems do we run, and where does our data live? Take an hour and make the list.
- Every system holding customer, client, or financial data: email, CRM, accounting, file storage, line-of-business applications.
- Every laptop, phone, and server that touches those systems.
- Who has access to each one, including contractors and people who have left. This part is usually the surprise. Remove the names that should not be there while you are looking.
It does not need to be comprehensive. You are looking for the handful of systems that matter, and the pile of forgotten ones sitting around them.
03 Step three
Put protection on every device
You need endpoint protection on the devices your people use. That is the modern version of antivirus. It does not only look for known viruses. It watches for behaviour that looks like an attack and can stop malware from moving across your network.
For most small companies, Microsoft Defender, built into Microsoft 365, covers you to a reasonable standard. If you want centralised management, one screen showing every device and its status, products like Sophos, CrowdStrike, and Trend Micro add that. The cost is small compared to responding to an actual incident.
04 Step four
Back up, and then prove the backup works
Ransomware is the attack that can actually shut a small company down: someone locks your files and asks for money. If it happens, the position you want to be in is the one where you can restore from a backup and get back to work. Paying the attacker does not guarantee you get your files back.
The test is not "we have a backup." The test is "we have a backup that works." If it has never been restored, treat it as not working until you have proved otherwise. Do not wait until you need it to find out.
- Back up the systems from step two that you could not rebuild from scratch.
- Keep a copy offsite and offline. A backup sitting next to the computers it protects gets encrypted by the same attack.
- Do a test restore a few times a year, and write down what you did. If nobody has ever restored, assume it does not work until proven otherwise.
For most companies this means the built-in cloud file recovery in Microsoft 365 or Google Workspace, plus a proper backup product for documents and databases. The discipline is the restoration test, not the software.
05 Step five
Find the accounts nobody remembers
Over the years, access accumulates. The freelancer who built the website still has the hosting login. The developer who configured the server never gave back the SSH key. The old employee is on a shared admin account that someone renamed but never removed. There is a domain and DNS somewhere that nobody can remember paying for.
None of this is unusual, and each of these accounts is a way into your systems. Work through it:
- Review who can reach systems from outside the office: VPN, remote access, hosting panels, cloud consoles.
- Remove access as part of offboarding, so it never depends on someone remembering later.
- Shared admin accounts should either go away or get an owner. If a password is shared, at least one person needs to own it and it needs to be rotated when they leave.
- List every domain you own and who controls the DNS. Losing DNS access is a real outage risk that has nothing to do with attackers. It is just as bad when it happens.
06 Step six
Patch and update on a schedule
Most compromises involving known vulnerabilities could have been prevented by a patch. The reason patches do not happen is mundane: no one owns the task. Security updates for operating systems, applications, and anything exposed to the internet need a schedule and an owner.
If you do not have someone whose job this is, that is a gap. It can be your internal IT person, or an outside provider running patching for you. What does not work is assuming someone, somewhere, is doing it.
07 Step seven
Teach your people to pause
Your staff are the way attackers get in. A convincing email, a login page that looks real, a request to pay an invoice to changed bank details. Training is not about turning your team into security experts. It is about making them pause for three seconds.
Three skills cover most of it:
- Spotting a suspicious email. Urgency, a request you did not expect, an address that is slightly wrong, a login link you did not ask for. When in doubt, do not click. Forward it.
- Verifying payment changes. If someone emails about changed bank details or a new invoice, confirm on a number you already have. Not the number in the email.
- Reporting mistakes honestly. An employee who says "I clicked something I shouldn't have" immediately is worth more than one who says nothing for two weeks.
Short and regular beats a long annual course. We run phishing simulations and measure whether behaviour actually changes, rather than whether someone clicked through a module.
08 Step eight
Get an independent look at your environment
Once the basics above are in place, have someone who does not work for you audit the environment. An external security audit and penetration test finds what people inside the company are blind to. On one manufacturer engagement, the previous provider had missed three critical exposure points for two years. The staff were not careless. Nobody was looking at those gaps.
A good audit ends with a prioritised list of findings in plain language. What is highest risk, who should fix it, and what to do. It is not a report that sits in a drawer. If that is what you get, the audit was not done properly. This is where our security audits come in, and it should happen at least once a year. If you are wondering what one of these tests actually costs, we wrote that up here.
09 Step nine
Assign someone to stay accountable
Security decays. MFA gets disabled for a "trusted" user. A contractor appears in a new login list. A backup test gets skipped once, then twice. A year later you are roughly back where you started. The difference between companies that stay secure and companies that were secure once is simple: someone owns the responsibility.
It can be an internal IT person, or a managed provider. What matters is there is a name attached to "are we still doing the basics," a quarterly review of the access list, and the annual audit booked before the year starts. If you do not have someone to hold that responsibility, that is what managed IT is for.
Most of these steps cost small amounts of money and take an afternoon. They are not exciting, which is exactly why they get skipped. The businesses that do them consistently are the ones that stay out of trouble.
