Small Business Breach Prevention: 90-Day Plan (2026)
Follow a practical 90-day breach prevention plan for small businesses, covering MFA, patching, backups, vendors, incident response, and security metrics.
Bottom Line
Start with three moves—reduce what's exposed online, turn on stronger sign-in, and patch known vulnerabilities first. This guide shows what to do, who owns each step, and how to measure progress. Clear steps you can delegate to your IT provider or implement yourself.
Scope and Sources
Who this is for: U.S.-based organizations with 5–50 employees using Microsoft 365 or Google Workspace with outsourced or part-time IT support.
What this does not cover: Compliance-specific frameworks (HIPAA, PCI DSS, CMMC), enterprise-scale SIEM/SOAR, or physical security beyond device management.
Sources: 2026 Verizon DBIR, CISA KEV Catalog, CISA MFA Guidance, Microsoft Entra identity research, FTC Data Breach Response Guide, and 20+ years of iFeelTech MSP field experience. Reviewed and updated August 2026.
60-Second Business Health Check
Answer yes or no to these five questions. Each links to the section that tells you what to do next.
Quick Assessment
- ☐ All staff use MFA; privileged users use phishing-resistant MFA where supported → Stronger Sign-In
- ☐ We can list every website, service, or system accessible from the internet → Reduce Exposure
- ☐ We know who to call and what to do if an account is compromised → Incident Response
- ☐ Backups exist and we've successfully restored something in the last 90 days → Backups
- ☐ Vendors and contractors have their own logins that expire automatically → Vendor Access
Basic controls reduce several of the most common and consequential entry paths. Fixing these fundamentals is straightforward, affordable, and measurably lowers your exposure.
Why This Matters in 2026
The global 2026 Verizon Data Breach Investigations Report SMB segment—defined as organizations with fewer than 1,000 employees, broader than this guide's U.S.-focused 5–50 employee audience—reveals three trends that directly affect small businesses:
- Vulnerability exploitation appeared in 26% of SMB breaches, making it the leading initial access vector. Unpatched internet-facing systems—VPNs, firewalls, and remote access tools—are the primary targets.
- Third-party involvement reached 55% of SMB breaches. Compromised vendor software, service-provider access, and supply-chain attacks are no longer enterprise-only problems.
- The human element was present in 45% of SMB breaches, including social engineering that now extends beyond email into phone calls, text messages, and mobile channels. Credential abuse accounted for 13% and phishing for 9% as standalone vectors.
The good news: basic controls reduce several of the most common and consequential entry paths. Attackers exploit unpatched software on internet-facing systems, abuse stolen credentials, and walk through misconfigured vendor access. This playbook addresses those exact vulnerabilities with practical steps you can delegate or implement yourself.
The Three Big Moves That Cut Risk Fast
1. Reduce What's Exposed to the Internet
What It Is
Every service, website, or admin panel accessible from the internet is a potential entry point. In our experience, businesses often discover forgotten test sites, old remote access portals, or admin consoles that should not be publicly accessible.
Why It Matters: Fewer exposed services mean fewer targets. Removing unnecessary exposure is one of the fastest ways to reduce your attack surface—especially given that the 2026 DBIR SMB segment shows vulnerability exploitation in 26% of breaches, more than any other single initial access vector.
Quick Action (30 minutes): List every website, app, or service your business uses that can be accessed from outside your office. Include your website, email, file storage, accounting software, remote desktop, security cameras, and any admin panels.
Owner To-Dos
- Review the list with your team—does each service need to be accessible from anywhere?
- Decide what can be removed or restricted to office-only access
- Approve protecting essential services with single sign-on (SSO)
IT Provider To-Dos
- Create an inventory of all internet-facing services and subdomains
- Remove or disable anything nonessential
- Centralize authentication through SSO, enforce conditional access, and restrict sensitive admin interfaces through ZTNA, VPN, identity-aware proxy, or IP allowlisting where appropriate
- Provide a before/after list to the owner with justification for what stays exposed
2. Implement Stronger Sign-In for Everyone
What It Is
Multi-factor authentication (MFA) adds a verification step beyond your password—usually an app prompt on your phone or a security key. Passkeys can replace passwords entirely, providing phishing-resistant MFA in a single gesture. Both make stolen credentials far less useful; FIDO-based passkeys also resist credential-relay phishing.
Why It Matters: Credential abuse remains a major entry path in the 2026 DBIR. Microsoft's Entra identity research reports that MFA can block more than 99.2% of account-compromise attacks in their telemetry. However, weaker MFA methods (SMS, push notifications without number matching) can be bypassed through MFA fatigue attacks, adversary-in-the-middle phishing, or session theft. CISA recommends phishing-resistant MFA—specifically FIDO2/WebAuthn passkeys—where platform support allows.
Quick Action (15 minutes): Turn on MFA for your email and file storage accounts—these unlock everything else in your business. Most platforms have a security settings page where you can enable "two-factor authentication" or "multi-factor authentication." Prioritize passkeys or hardware keys where available.
Owner To-Dos
- Announce company-wide MFA requirement with a 1-week deadline
- Set policy: MFA is required for covered systems; any temporary exception must have a documented owner, mitigation, and expiration date
- Ask the IT provider for the completion report and list of any exceptions
IT Provider To-Dos
- Enable MFA/passkeys for all users across email, file storage, and admin accounts
- Block legacy sign-in methods that bypass MFA
- Prioritize phishing-resistant options (passkeys, hardware keys) for admins
- Document any systems that don't support MFA and create a mitigation plan
3. Patch What Attackers Are Actually Using
What It Is
Known-exploited vulnerabilities are software bugs that attackers are actively exploiting to break into systems. CISA maintains a public catalog of these high-priority issues.
Why It Matters: With vulnerability exploitation as the leading SMB initial access vector (2026 DBIR, 26%), patching internet-facing systems is more urgent than ever. VPNs, firewalls, and remote access tools are primary targets.
Quick Action (1 hour): Ask your IT provider: "Do we have any known-exploited vulnerabilities on our internet-facing systems?" We recommend a 72-hour fix standard for anything on CISA's KEV list. When patching cannot meet that window, immediately isolate the affected system or apply compensating controls (vendor-provided mitigations, network isolation, access restriction, or disabling the vulnerable service).
Owner To-Dos
- Set clear policy: known-exploited issues on public-facing systems should be fixed within 72 hours (our recommended standard; some CISA advisories call for faster action on internet-facing systems)
- Approve maintenance windows for urgent patches
- Request a monthly report showing patch status for critical systems
IT Provider To-Dos
- Monitor CISA KEV Catalog and vendor security advisories
- Prioritize patches for internet-facing systems (VPNs, firewalls, web servers)
- Apply compensating controls when immediate patching isn't possible: vendor-provided mitigations, access restriction, service disabling, network isolation, or enhanced monitoring
- Track and report percentage of KEV items fixed within SLA and the age of the oldest overdue item
- Consider automated patch management tools like Action1 (free for up to 200 endpoints as of August 2026; free-tier users receive community support rather than standard support) to reduce manual oversight
Protect Your Essential Business Functions
Email and Domain Protection (20 minutes to start)
What It Is
Email authentication (SPF, DKIM, and DMARC) protects against direct spoofing of your domain when correctly configured and enforced with a p=quarantine or p=reject policy. A p=none policy only monitors—it does not block spoofed messages. See DMARC.org FAQ and the FTC email-authentication guide for details.
Why It Matters: Invoice fraud, wire transfer scams, and phishing attacks often use spoofed sender addresses. DMARC blocks direct domain spoofing when aligned and enforced, but it does not stop lookalike domains (e.g., yourcompany-invoices.com), display-name impersonation, compromised legitimate accounts, or social engineering via calls and texts.
Quick Action: Check if your domain has DMARC protection using a free online checker. If the policy is p=none, work with your IT provider to move toward p=quarantine and eventually p=reject after monitoring for legitimate mail that might be affected.
Owner To-Dos
- Verify DMARC is enabled for your domain
- Request quarterly reports on blocked spoofing attempts
- Establish a clear process for staff to report suspicious emails
Backups That Actually Restore (Test quarterly)
What It Is
Backups are copies of your critical business data stored separately from your production systems. Immutable or offline backups cannot be encrypted or deleted by ransomware that compromises your network.
Why It Matters: Ransomware attacks lock your files and demand payment. Clean, tested backups let you restore operations without paying—but restoration is not instant. It may require forensic investigation, clean system rebuilds, identity remediation, and regulatory notifications. Backups also cannot undo data exfiltration: in double-extortion ransomware, attackers steal data before encrypting it. See CISA's ransomware guide for current recommendations.
Quick Action: Identify your five most critical business systems or data sets. Define your Recovery Point Objective (RPO—how much data loss is acceptable) and Recovery Time Objective (RTO—how quickly you need systems back). Schedule a restore test for one system this month—actually pull the files back and verify they work.
Owner To-Dos
- Define what data is critical and cannot be lost
- Set quarterly restore test requirement
- Ask: "If we were hit by ransomware today, how long would it take to recover?"
IT Provider To-Dos
- Implement 3-2-1 backup strategy (3 copies, 2 different media, 1 offsite) with at least one immutable or offline copy
- Use separate credentials for backup administration (not the same as production admin accounts)
- Encrypt backups in transit and at rest
- Test restores quarterly and document actual recovery time against RPO/RTO targets
- Protect backup admin consoles with MFA and network restrictions
Endpoint Protection on Every Device (begin within one week; complete within 30 days)
What It Is
Endpoint Detection and Response (EDR) is a monitored detection-and-response layer that goes beyond traditional antivirus. Modern antivirus already uses behavior monitoring, heuristics, cloud analysis, and machine learning—not just signature matching. EDR adds continuous visibility, investigation, correlation across endpoints, and automated or manual response capabilities. See Microsoft's behavioral-protection documentation for how these layers work together.
Why It Matters: EDR can detect or block some previously unseen attacks through behavioral analysis—for example, flagging a process that suddenly begins encrypting large numbers of files. Its effectiveness depends on whether alerts are actively monitored (by your IT provider or a managed detection and response service) and whether the product is configured to block automatically or only alert. For help choosing the right platform, see our CrowdStrike vs SentinelOne vs Bitdefender comparison.
Quick Action: Ask your IT provider: "Do we have EDR on all endpoints and servers, and who monitors the alerts?"
Owner To-Dos
- Approve EDR deployment to 100% of devices
- Request a monthly coverage report
- Clarify who monitors alerts and responds to detections
Learn more about selecting the right cybersecurity tools for your business size and industry.
Work Safely With Vendors and Contractors
What It Is
Vendor access management means giving external partners their own temporary logins with only the permissions they need—never sharing your staff accounts or giving permanent, broad access.
Why It Matters: The 2026 DBIR SMB segment reports that 55% of breaches involved a third party. This broad category includes supply-chain compromise, vendor software vulnerabilities, service-provider access, and contractor accounts. When any third-party relationship is compromised, attackers use it to reach your systems.
Quick Action: Review current vendor access. Who has login credentials to your systems? Are any of those accounts shared or permanent?
Owner To-Dos
- Set policy: No shared accounts for vendors; all access expires at project end
- Require quarterly review of active vendor accounts
- Ask for a list of vendors with privileged access and their expiration dates
IT Provider To-Dos
- Create separate identity for each vendor with scoped permissions
- Set automatic expiration (30-90 days typical)
- Require MFA for all vendor accounts
- Log and review privileged vendor actions monthly
Your 90-Day Implementation Plan
Days 1-30: Close Obvious Gaps
Week 1:
- Complete 60-second health check
- Create inventory of internet-facing services
- Enable MFA on email and file storage for all users
- Deploy password manager to all staff
Week 2:
- Remove nonessential internet-facing services
- Request KEV vulnerability scan on public-facing systems
- Verify DMARC protection is active (check enforcement level—
p=noneonly monitors) - Begin EDR deployment to all endpoints and servers
Week 3:
- Patch any KEV-listed vulnerabilities found
- Lock down exposed admin panels behind SSO
- Test one critical system backup restore and document RPO/RTO
- Enable full-disk encryption on all company devices
Week 4:
- Complete rollout of MFA to 100% of users (prioritize phishing-resistant methods for admins)
- Complete EDR deployment to 100% coverage
- Document what stays internet-accessible and why
- Review month 1 progress with IT provider
Days 31-60: Strengthen Identity, Training, and Logging
Week 5-6:
- Roll out single sign-on (SSO) for core business apps
- Implement least-privilege access controls
- Set up just-in-time admin elevation
- Conduct first security awareness training (cover email phishing, vishing, smishing, and payment-verification procedures)
- Establish shadow-AI policy: define approved AI tools and data-handling rules
Week 7-8:
- Centralize identity, endpoint, and cloud logs
- Configure high-priority alerts to reach on-duty responder
- Review and retire duplicate or abandoned accounts
- Audit employee offboarding process (offboarding guide)
Days 61-90: Build Response and Resilience
Week 9-10:
- Verify at least one backup copy is immutable or offline
- Create vendor access workflow with auto-expiry
- Complete data inventory: identify what sensitive data you hold, where it lives, and retention requirements
- Move DMARC policy toward
p=quarantineorp=reject
Week 11-12:
- Complete and print incident response plan (see template above)
- Run tabletop exercise with key staff
- Document improvements needed based on exercise
- Define RPO/RTO targets for all critical systems
- Conduct 90-day security review and plan for next quarter
Copy-and-Send Email Templates
Template 1: Initial Request to IT Provider
Email Template
Subject: Security improvements—starting this week
Hi [Name],
I'd like to prioritize three security improvements this month:
-
MFA everywhere: Please enable phishing-resistant MFA for all users and admins across email, file storage, and admin systems. Target: 100% coverage by [date]. Send me confirmation and note any exceptions.
-
Internet exposure: Please provide a list of all our internet-facing services and systems. Include recommendations for what we can remove or restrict.
-
Known vulnerabilities: Please check for any CISA KEV-listed vulnerabilities on our public-facing systems and patch within 72 hours. Going forward, this becomes our standard.
Let's schedule 30 minutes this week to review the plan.
Thanks, [Your name]
Template 2: Monthly Security Check-In
Email Template
Subject: Monthly security status—[Month]
Hi [Name],
Please provide brief updates on these items by [date]:
- MFA coverage: What % of users are now using MFA? Any holdouts or issues?
- Patching: Any KEV vulnerabilities outstanding on internet-facing systems? If yes, what's the plan?
- Backups: When was the last restore test? Results?
- Vendor access: How many active vendor accounts? Any that should expire?
- Incidents: Any security alerts or suspicious activity this month?
Thanks, [Your name]
Template 3: Vendor Security Requirements
Email Template
Subject: Access requirements for [Project name]
Hi [Vendor name],
For security and compliance, all vendor access must follow these requirements:
- Separate login credentials (not shared with our staff)
- Multi-factor authentication enabled
- Access limited to systems needed for this project
- Automatic expiration on [project end date + 30 days]
Please coordinate with our IT team ([contact]) to set up your access. They'll provide credentials and confirm scope.
Thanks, [Your name]
Incident Response Plan
Print this and keep it accessible. Update contact information quarterly. For detailed federal guidance, see the FTC Data Breach Response Guide.
When Something Seems Wrong
Trigger events: Suspected account compromise, ransomware/malware detection, unusual admin activity, data exposure, wire transfer or payment fraud attempt
Step 0: Activate and Preserve (Immediate)
- Designate an incident commander (typically the business owner or senior leader)
- Preserve all evidence and logs—do not reimage, delete, or power off systems unless containment requires it (FTC: "Do not destroy evidence")
- Contact legal counsel and cyber insurance provider immediately—they may direct forensics and set legal hold requirements
- Establish a pre-approved secure out-of-band communication channel (phone, approved messaging app) in case business email is compromised
- Begin an incident action log: timestamp every decision and action from this point forward
Step 1: Triage (First 15 minutes)
- What happened? When? Who discovered it?
- Which accounts or systems are affected?
- Is it still active or spreading?
- What severity band applies? (Identity compromise and ransomware should target containment in hours, not days)
Step 2: Contain (Immediate—preserve before you clean)
- Isolate affected devices from the network (disconnect, do not power off)
- Disable compromised user accounts and revoke active sessions
- Revoke access tokens and API keys if involved
- Block known malicious indicators (IPs, domains, file hashes)
- If money was transferred or payment details were changed: contact the financial institution's fraud department immediately and file at IC3.gov. Do not wait for the general investigation to finish
Step 3: Investigate (First 24 hours, coordinate with forensics)
- Engage forensic investigators if directed by counsel or insurer
- Establish timeline of events from preserved logs
- Identify entry point and method
- Determine what privileges were used and escalated
- Identify what data was accessed or exfiltrated
- Determine regulatory notification obligations (state breach-notification laws, HIPAA, etc.)
Step 4: Eradicate (Once contained and evidence is preserved)
- Apply security patches to affected systems
- Rebuild compromised devices from clean images (do not simply reimage before forensic collection)
- Remove malware persistence mechanisms
- Fix configuration issues that enabled entry
- Reset credentials for all affected and potentially affected accounts
Step 5: Recover (When clear)
- Restore systems from verified clean backups
- Re-enable user access gradually with enhanced monitoring
- Verify systems are functioning normally
- Resume normal business operations
Step 6: Notify on applicable deadlines; begin lessons learned within one week
- Complete regulatory notifications on the deadlines determined in Step 3 (these vary by state, sector, contract, and insurer—do not assume one week is sufficient)
- Notify affected parties if required by law
- Document root cause and complete timeline
- Identify control gaps that allowed the incident
- Update processes and technical controls
- File the incident action log for future reference
Key Contacts (fill in and print)
- Incident Commander: [Name, phone, out-of-band contact]
- IT Provider / MSP: [Name, phone, email, after-hours number]
- Internal IT Lead: [Name, phone, email]
- Legal Counsel: [Name, phone, email]
- Cyber Insurance: [Provider, policy #, breach hotline phone]
- Forensics Retainer (if applicable): [Firm, phone, email]
- Law Enforcement: [Local FBI field office, IC3.gov, non-emergency number]
Track What Matters: Simple Security Metrics
Review these monthly with your IT provider. Track trends, not just point-in-time snapshots.
| Metric | What to Track | Target |
|---|---|---|
| Internet Exposure | Count of internet-facing services | Declining or stable with justification |
| MFA Adoption | % of users with MFA enabled | 100% |
| Patching Speed | % of KEV items fixed within SLA; oldest overdue item age | ≥95% within SLA; no item overdue >7 days |
| Endpoint Coverage | % of devices with EDR deployed | 100% |
| Backup Health | Days since last successful restore test | ≤90 days |
| Vendor Access | Count of active vendor accounts | All with expiration dates |
| Incident Response | Hours from alert to containment (by severity) | Identity/ransomware: target hours; other: track and improve |
Common Pitfalls and How to Avoid Them
Pitfall: Shadow IT and unmanaged SaaS apps
Prevention: Require all new apps to go through IT approval. Run quarterly SaaS discovery scans. Enforce SSO for all business tools—if an app can't integrate with SSO, it needs executive approval as an exception. For a structured approach to finding and scoring every tool in your stack, see the Tech Stack Teardown.
Pitfall: Permanent admin rights
Prevention: Replace standing admin access with just-in-time elevation. Admins request temporary elevated rights for specific tasks with automatic time limits and approval workflows.
Pitfall: Slow or incomplete patching
Prevention: Create a separate "security fast lane" for edge devices and KEV-listed issues. Non-critical patches can follow the standard monthly cycle, but we recommend known-exploited vulnerabilities on internet-facing systems get a 72-hour SLA. When that window cannot be met, isolate the system or apply compensating controls immediately.
Pitfall: Backups you can't actually restore
Prevention: Schedule restore tests quarterly. Actually pull files back, open them, and verify they work. Record how long it took and compare against your RPO/RTO targets. Fix problems before you need the backup in a real emergency. Keep restore-test records as evidence artifacts for insurance and compliance.
Pitfall: Vendor access that never expires
Prevention: Every vendor account gets an expiration date at creation. Set calendar reminders to review active vendor access quarterly. Auto-disable interactive human accounts that haven't been used in 60 days (service accounts and integrations require a separate non-human identity policy with periodic credential rotation). For internal staff, ensure you have a hardened employee offboarding process to prevent similar persistent access.
Pitfall: No payment-change verification process
Prevention: Require independent verification for any change to payment details—call the vendor at a previously known number (not one provided in the request). Require dual approval for bank-detail changes and delay high-risk modifications by 48 hours. This applies to email, phone, and text requests equally. Email authentication alone does not stop compromised-account or lookalike-domain fraud.
Pitfall: No shadow-AI policy
Prevention: Staff may use AI tools that process company data without IT awareness. Define which AI tools are approved, what data categories may be submitted, and how outputs should be reviewed. Treat unapproved AI tools like unapproved SaaS—require IT review before use.
Illustrative Scenarios: How These Controls Work Together
These scenarios illustrate how common attacks succeed or fail depending on which controls are in place. They are composite examples based on patterns we see in MSP practice, not specific client engagements.
Invoice Fraud Attempt
A small architecture firm receives an email requesting updated payment details for an upcoming order. The email uses the correct logos and signature of their regular supplier.
Without protections: The controller updates the payment information and processes the next invoice—funds go to the attacker's account.
With layered controls: If the attacker spoofed the firm's own domain, DMARC (at p=reject) blocks the message. But DMARC would not stop a message from a compromised supplier account, a lookalike domain, or a phone call. The stronger defense is a workflow control: the firm requires staff to verify any payment-detail change by calling a known supplier number (not the number in the email), requires dual approval for bank-detail changes, and delays high-risk payment modifications by 48 hours.
Ransomware Recovery
A medical practice gets hit with ransomware that encrypts patient files and billing records.
Without protections: The practice has no recent backups. Patient care is disrupted for weeks. Many businesses in this situation pay the ransom and still don't recover all their files.
With tested backups and an incident response plan: The practice activates its incident response plan, preserves logs for forensic investigation, and contacts legal counsel and their cyber insurance provider. After forensic clearance, the IT team restores from the most recent immutable backup. Recovery takes time—forensic investigation, clean system rebuilds, credential resets, and verification—and the practice should expect some data loss between the last backup and the incident (typically up to one business day with nightly backups). If the attackers exfiltrated data before encrypting, the practice still faces notification obligations regardless of successful restoration.
Credential Stuffing Attack
An employee's personal email and password were exposed in a data breach at a retail website. Attackers use automated tools to try that combination on thousands of business services.
Without protections: The employee reused their password. Attackers log into the company's project management tool and access client contracts.
With MFA + password manager: The MFA requirement blocks the automated login attempt. Ideally, the employee also uses a password manager that generates unique passwords per service, preventing credential reuse in the first place.
Frequently Asked Questions
Does implementing these controls replace our need for cyber insurance?
No. Good security controls reduce your risk and may lower your premiums, but insurance may be an appropriate financial backstop for residual risk depending on your business and the coverage available. The FTC describes cyber insurance as an option whose suitability depends on business size, data sensitivity, and policy terms. Cyber-insurance applications commonly ask about MFA, endpoint protection, backups, and incident response; requirements vary by insurer and policy.
How much will this cost for a business with 10-25 employees?
Costs vary by stack and whether you use an MSP. Here is a sample itemized budget. U.S. list prices before tax; verified August 10, 2026; annual billing:
| Item | Cost |
|---|---|
| Microsoft 365 Business Premium (includes Entra ID P1, Defender for Business, Intune) | $22/user/month |
| Or: Google Workspace Business Plus | $22/user/month |
| Workstation backup: Backblaze Computer Backup (covers local/external drives on workstations; does not cover Microsoft 365, Google Workspace, servers, or SaaS data) | $99/device/year |
| Password manager: 1Password Business | $8.99/user/month |
| Microsoft Defender for Business standalone (included in M365 Business Premium; other EDR/MDR products may be per-endpoint or quote-based; server protection may cost extra) | $3/user/month |
This does not include MSP/MDR labor, onboarding, server licenses, SaaS-specific backup, or backup storage overages. Many controls in this guide (reducing internet exposure, improving patching process, vendor access review) cost only time.
What if my staff complain about MFA being inconvenient?
Modern MFA—especially passkeys—is generally faster and more seamless than traditional passwords, with experience varying by platform and enrollment. MFA is required for covered systems. Any temporary exception should have a documented owner, mitigation, and expiration date.
We're too small to be a target. Do we really need this?
Automated scanning tools probe internet-facing systems regardless of company size. The 2026 DBIR SMB segment shows vulnerability exploitation in 26% of breaches and third-party involvement in 55%. Basic controls block many of the most common automated attack paths.
Can we phase this in over 6-12 months instead of 90 days?
You can, but risk remains elevated during the delay. The 90-day plan prioritizes the highest-impact controls first. If you need to stretch the timeline, focus on the "Days 1-30" items (MFA, reduce exposure, patch KEV issues) immediately and phase in the rest.
What role does employee training play?
Training supports—rather than substitutes for—technical and workflow controls. The FTC treats regular training as part of a complete security program. Start with strong technical controls (MFA, EDR, backups), then build training that covers current social engineering channels—including phone calls (vishing), text messages (smishing), and mobile-app-based attacks, not just email phishing. Training is most effective when it reinforces specific procedures, such as verifying payment changes by phone.
How do I know if my IT provider is doing a good job with security?
Ask specific questions from this guide: MFA coverage percentage, KEV patching timeline, backup restore test results, and vendor access expiration dates. If they can't answer or push back on implementing these basics, that's a red flag. Consider getting a second opinion through an independent security assessment.
What if we get breached even after implementing all of this?
No security is perfect. These controls measurably reduce risk and limit damage when something does get through. Your incident response plan and tested backups support faster recovery—though recovery timelines depend on the type and scope of the incident. Document what happened, fix the gap, and improve. That iterative process is how mature organizations build resilience.
Decision Framework: Good, Better, Best
Not every business needs the most advanced security controls. Use this framework to match your investment to your risk profile.
| Security Area | Good (Start Here) | Better (Next Step) | Best (Mature) |
|---|---|---|---|
| Authentication | App-based MFA for all | Passkeys for staff; hardware keys for admins | Passkeys + conditional access (device health checks) |
| Patching | Monthly cycle | KEV items on internet-facing systems within 1 week | 24-72h SLA for edge devices with compensating controls |
| Backups | Daily cloud backup with defined RPO | Quarterly restore tests documented; at least one immutable copy | Immutable + offline copies; tested recovery procedures; separate backup credentials |
| Vendor Access | Named accounts + MFA | Auto-expiry + scoped roles | Just-in-time access + full audit trail |
| Endpoint Protection | Modern antivirus with behavioral monitoring | EDR on all endpoints with alert monitoring | EDR + MDR with 24/7 monitoring |
| Monitoring | Basic logs collected | Centralized logging + high-priority alerts | SIEM with tuned detection rules and SOC response |
| Incident Response | Know who to call | One-page playbook documented | Quarterly tabletop exercises + retainer with IR firm |
Most small businesses should target the "Better" column for critical systems within 90 days, then work toward "Best" over the following year based on risk and budget.
When to Consider Professional Help
Some businesses can implement these controls with their existing IT provider. Others benefit from specialized security expertise. Consider bringing in a security professional or managed service provider when:
Signs You Need Expert Help
- Your IT provider pushes back on implementing basic controls or can't explain current security posture
- You operate in a regulated industry (healthcare, finance, legal) with compliance requirements
- You've experienced a security incident and need independent assessment
- You're planning significant infrastructure changes (cloud migration, office expansion, merger)
- Your business handles sensitive customer data or intellectual property
- You need 24/7 monitoring and response but don't have in-house staff
Next Steps
Start with three moves this month: reduce your internet exposure, enable phishing-resistant MFA, and patch known-exploited vulnerabilities on internet-facing systems.
Use the 90-day plan, email templates, and metrics framework to maintain momentum. Print the incident response plan, schedule your first tabletop exercise, and test a backup restore this quarter.
Consistent execution of fundamentals measurably reduces your exposure. Start this week.
Related Resources
- Best Cybersecurity Software for Small Business – Tool recommendations
- NIST CSF 2.0 Cybersecurity Tools – Framework guide
- VPN vs Zero Trust Guide – Access security
- Best Business Password Managers – Password security
- Malwarebytes Business Review – Endpoint protection
- Synology Snapshots Explained – Backup strategy
- Double Extortion Ransomware: Why Backups Aren't Enough – Data exfiltration risk
- Small Business Disaster Recovery Guide – Business continuity planning
- How to Spot a Phishing Email – Security awareness training
- Cybersecurity Services – Professional support
Related Articles
More from Cybersecurity
ClickFix and Copy-Paste Attacks: The Social Engineering Threat for Small Businesses
ClickFix is now the dominant initial-access method for malware in 2026. Learn how fake support prompts, CAPTCHA attacks, and copy-paste malware work — and what to do when someone on your team runs the command.
15 min read
The 7-Step Network Security Audit Every Small Business Should Do Quarterly (Jan 2026 Edition)
Quarterly security audit guide for small businesses. 2-hour systematic process covering Passkey adoption, software updates, immutable backup verification, network access, and incident response planning.
13 min read
Double Extortion Ransomware: Why Backups Alone Aren't Enough
Data exfiltration appears in 96% of BlackFog-tracked Q1 2026 ransomware incidents. Backups restore access but don't resolve data exposure. Here's what actually protects your business.
13 min read