IT security basics for small businesses

The most important security steps for a small business are turning on multi-factor authentication for email and every important account, keeping devices updated, keeping tested backups that an attacker can't reach, and teaching staff to spot phishing. None of these is expensive, and together they block the most common ways small businesses get hacked.

Attackers rarely target a small business because of who it is. They go after whoever is easiest, usually through a reused password or a convincing email. The goal is to stop being easy.

Turn on multi-factor authentication everywhere

Multi-factor authentication (MFA) means logging in with a password plus a second check, such as a code from an app or a prompt on your phone. It stops most attacks that rely on stolen passwords.

Start with the accounts that matter most: email (Microsoft 365 or Google Workspace), banking and payroll, your accounting software, your domain registrar, and any admin accounts. Authenticator apps or security keys are safer than codes sent by text message, but a text code is far better than nothing.

Use a password manager

People reuse passwords because they can't remember dozens of them. A business password manager fixes that by creating and storing a strong, unique password for each account, and lets you share logins with staff without writing them on sticky notes. When someone leaves, you can see which accounts they had access to and change those passwords.

Keep everything updated

Updates fix security holes that attackers already know how to use. Turn on automatic updates for computers, phones, and browsers. Don't forget the devices people overlook: your Wi-Fi router, firewall, printers, and any camera or door systems. Replace equipment once the manufacturer stops providing security updates for it.

Keep backups you've tested

Ransomware locks your files and demands payment. A good backup lets you restore instead. Follow the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy off-site or in a separate cloud account that can't be changed or deleted from your main systems.

Then test it. Restore a few files every quarter to prove the backup works. Include cloud data: email and files in Microsoft 365 or Google Workspace need their own backup plan.

In Central Florida, off-site backup also protects you from hurricanes, flooding, and power loss, not just hackers.

Train your team to spot phishing

Phishing emails try to get someone to click a link, open an attachment, or send money. Teach staff a few habits:

• check the sender's actual email address, not just the display name
• be suspicious of urgency, such as "pay this today" or "your account will be closed"
• don't enter a password on a page you reached from an email link
• confirm any request to change bank details or send money by calling a known number

Payment fraud through fake invoices and changed bank details is common. Make it a rule that any change to where you send money gets verified by phone, using a number you already have on file.

Limit who has admin access

Day-to-day accounts shouldn't have administrator rights. Give admin access only to the people who need it, and have them use a separate admin account for that work. When an employee leaves, turn off their accounts the same day.

Protect your devices and network

Use the built-in protection on your computers or a business endpoint security tool, and turn on disk encryption so a lost laptop doesn't mean lost data. Set up a separate guest Wi-Fi network for visitors and personal devices, and change default passwords on routers and other equipment.

Write down a simple plan

Know who to call if something goes wrong: your IT provider, your bank, and your insurance company if you have cyber coverage. Keep a printed list of key contacts and account details somewhere safe. Even a one-page plan saves time when you're under pressure.

For free, practical guidance, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) publishes resources for small businesses at cisa.gov.

When to get outside help

If you don't have time to set this up, or you're not sure it's working, an IT provider can do an assessment and handle it as part of ongoing support. Our guide on what to look for in a managed IT provider explains what security they should include as standard. When you're ready, tell us what you need and we'll connect you with a local IT provider in Central Florida. Providers are independent businesses.