Running a small company means security lands on you, not on a big IT team. Good cybersecurity for small business starts with a few habits: phishing-resistant multi-factor authentication, long unique passphrases, tested backups, updates and a written incident plan.
This guide is part of our look at technology in business, where security sits alongside the tools you use every day.
| Item | Value |
|---|---|
| Minimum password length in NIST guidelines | At least 15 characters |
| Multi-factor authentication NIST advises | Phishing-resistant, on all accounts that offer it |
| Security Program Manager progress report to leaders (CISA) | At least monthly |
| Incident response plan review (CISA) | Quarterly, and after every incident or near miss |
| Backups (NIST) | Back up regularly, protect and test them |
| NIST basics page last updated | November 6, 2026 |
These figures come from NIST’s small business cybersecurity basics and CISA’s guidance for small businesses. Guidance can change, so check the sources before you rely on them.
Why security is a business decision, not just an IT task
CISA’s guidance states that culture matters as much as technology in security, and that culture cannot be delegated. In practice, that means the owner or CEO talks about security with staff, rather than leaving it to whoever fixes the printers.
The same guidance says small businesses often do not have the resources to defend against threats like ransomware. It also warns that much of the advice owners have heard is out of date, such as never using a coffee shop’s wi-fi. That fear had some truth a decade ago, but it is not how people and organizations are compromised today.
NIST adds a useful framing: cyber threats are a business risk, and strong cybersecurity can be a competitive advantage. It also calls security a continuous process, because your business, technology, laws and threats keep changing.
Lock down your accounts first
NIST’s first practical step is to enable phishing-resistant multi-factor authentication on every account that offers it. Start with the most sensitive ones:
- Banking
- Sensitive file storage
- Your password manager
- Business-critical cloud service accounts
For passwords, NIST recommends strong, unique passphrases of at least 15 characters and suggests a password manager to help. It also says to avoid relying on passwords where possible by using passkeys, and to change default manufacturer passwords to ones unique to you.
CISA is realistic about MFA: any form is better than none, and even text-message or authenticator codes raise the cost of an attack. Its guidance points to FIDO authentication as the phishing-resistant option and notes it is built into the browsers and smartphones you already use.
CISA also suggests the CEO announce the MFA rollout personally and follow up with anyone who has not switched it on. Waiting for the IT team to persuade busy staff rarely works.
Back up, update and limit access
Once accounts are protected, NIST’s list turns to everyday hygiene. These habits are cheap and do a lot of the work:
- Back up your data regularly, and protect and test the backups.
- Keep software updated on all devices and applications.
- Use standard user accounts instead of administrator accounts, with MFA wherever possible.
- Inventory the most important business assets and services the business relies on.
Every connected app is another account to protect. If you are unsure how business software talks to other software, our explainer on what is an api is a good place to start.
If your staff work from different places, the guide to the best remote work tools for small teams covers the tools, and each one still needs the account protections above.
Who does what in a small team?
CISA breaks the work down by role. The CEO sets the tone: talks about security with direct reports and the whole organization, includes security goals in quarterly planning, and tracks things like MFA adoption, patching and backups.
The CEO also picks a Security Program Manager. According to CISA, this person does not need to be a security expert or even an IT professional. They make sure the key elements of the program happen and report progress and roadblocks to senior leaders at least monthly, or more often at the start.
Their most important jobs include:
- Formally training all staff on enabling MFA, updating software, avoiding suspicious links and escalating suspicious activity.
- Writing and maintaining the incident response plan.
- Hosting regular attack simulations called tabletop exercises, which senior leaders should attend.
Prepare for an incident before it happens
CISA calls the incident response plan your action plan before, during and after a security incident. It should spell out roles and responsibilities, include an address book in case the network is down, be approved by leadership, and be reviewed quarterly and after every incident or near miss.
CISA’s pro tip is to invoke the plan even when you suspect a false alarm. Near misses drive improvement in the aviation industry, and the same can be true for your security program.
NIST adds one practical task: make a list of internal and external contacts for reporting attacks. Include law enforcement, legal counsel and incident response professionals, and keep a paper copy as a backup.
A simple order to work through
You do not need to do everything at once. A sensible sequence based on the two sources looks like this:
- Turn on phishing-resistant MFA for email, banking and file storage.
- Move to a password manager and long unique passphrases.
- Set up backups and test that you can restore from them.
- Turn on updates and remove administrator rights from everyday accounts.
- Name a Security Program Manager and train all staff.
- Write the incident response plan and the paper contact list.
For more structure, NIST lists a Cybersecurity Framework 2.0 Small Business Quick Start Guide for firms with modest or no cybersecurity plans. It also links a Cyber Readiness Institute resource, developed by a Small Business Advisory Council of 15 public and private organizations, that sets out seven fundamental cybersecurity actions.
Frequently asked questions
Where should a small business start with cybersecurity?
Show answer
NIST’s basics list begins with understanding that cyber threats are a business risk, then enabling phishing-resistant MFA on your most sensitive accounts. Backups and software updates follow close behind.
Is text-message MFA good enough?
Show answer
CISA says any form of MFA is better than none and raises the cost of an attack. It also says phishing is consistently the most cost-effective way for attackers to get in, which is why it urges businesses to learn about FIDO authentication.
Do I need an IT expert to run security?
Show answer
CISA says the Security Program Manager does not need to be a security expert or an IT professional. They need to drive the program, report to leaders and keep the plan current.
How often should the incident plan be reviewed?
Show answer
CISA recommends reviewing it quarterly and after every security incident or near miss. Practise it through tabletop exercises so people build reflexes before a real event.
