How to Build a Small Business Cybersecurity Plan in 30 Days

A small-business cybersecurity plan does not need to begin with expensive software, a dedicated security department, or a hundred-page policy. It needs to begin with clear priorities: know what you depend on, protect the accounts and devices that matter most, prepare for common attacks, create a recovery path, and make security part of normal work instead of an occasional emergency project.

This practical 30-day guide shows how a small business can build that foundation step by step. It is designed for owners, managers, small teams, freelancers who are beginning to hire, and organizations with limited IT resources. The goal is not to make a small company “unhackable.” No organization can promise that. The goal is to reduce avoidable risk, make attacks harder, limit damage when something goes wrong, and improve the company’s ability to recover.

The approach follows the logic of the NIST Cybersecurity Framework 2.0, which organizes cybersecurity outcomes around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. NIST also publishes a Small Business Quick-Start Guide specifically for organizations with modest or no existing cybersecurity plans. The Federal Trade Commission similarly emphasizes practical basics such as software updates, backups, access controls, employee awareness, email security, and planning for common attacks.

Cybersecurity begins with ordinary business assets: devices, accounts, files, networks, and the people who use them.

What you should have after 30 days

By the end of this process, your business should have a concise cybersecurity plan that a real person can follow. It should identify your most important systems and data, name the people responsible for security decisions, require stronger login protections, define how devices and software are maintained, establish backups, document how suspicious activity is reported, and explain what the business will do during and after an incident.

You should also have a short list of unfinished risks. That is important. A useful cybersecurity plan does not pretend that every weakness disappeared in one month. It makes remaining risk visible so you can decide what to address next based on business impact, cost, and urgency.

Before Day 1: choose a simple working format

Do not begin by shopping for a “cybersecurity platform.” Begin with a document and an inventory. A spreadsheet plus a shared document is sufficient for many small organizations. You can later move the information into a governance, ticketing, or security platform if the company grows.

Create one main document called something like Small Business Cybersecurity Plan. Create a companion spreadsheet with separate tabs for assets, accounts, vendors, risks, backups, incidents, and action items. Restrict access to people who genuinely need it because this material will reveal important details about your systems.

Your plan should be written in plain language. Avoid filling it with acronyms that employees do not understand. If the plan cannot be used during a stressful incident, it is not practical enough.

Days 1–3: define ownership before you define controls

Day 1: name one accountable owner

Every business needs a person who is accountable for making sure cybersecurity tasks happen. This does not mean that person must perform every technical task. In a very small company, the owner or operations manager may hold this responsibility. In a larger small business, it may be an IT manager, security lead, or trusted external provider working with an internal decision-maker.

Write the owner’s name and role at the top of the cybersecurity plan. Then name a backup decision-maker. If the main person is traveling, sick, or unreachable during an incident, someone else must be able to approve password resets, shut down services, contact vendors, or communicate with staff.

Common mistake: writing “IT is responsible” without naming a person. Shared responsibility often becomes no responsibility during an emergency.

Day 2: decide what cybersecurity protects for the business

Security is not only about computers. It protects business outcomes. Write down the consequences you most want to avoid. Examples include being unable to invoice customers, losing access to the company email domain, exposing customer contact information, having payroll redirected, losing project files, being locked out of an online store, or suffering a long outage during a busy sales period.

This exercise converts security from a vague technical problem into business risk. It also helps you prioritize. A five-person design studio may care most about client files and cloud accounts. A local retailer may care more about payment systems and point-of-sale availability. A consulting company may prioritize email, identity accounts, contracts, and laptops.

Day 3: create a decision rule for risk

You do not need a complicated risk model. Use three questions for every significant weakness:

• How likely is this problem to occur?
• How much operational, financial, legal, or reputational damage could it cause?
• How difficult and expensive is the fix?

Rate each item low, medium, or high. Focus first on weaknesses that are both likely and damaging, especially when the fix is inexpensive. Requiring multi-factor authentication on administrator accounts is a good example: it is usually far cheaper than recovering from an account takeover.

Days 4–7: identify what you actually have

Day 4: inventory business devices

Create a list of computers, phones, tablets, servers, routers, point-of-sale equipment, network storage, and other devices that store business information or connect to business systems. Include personally owned devices if employees use them for work.

For each device, record the user, operating system, approximate age, ownership, location, security status, update status, encryption status if known, and whether the device can be remotely locked or wiped.

Do not aim for perfection on the first pass. The important result is to discover the unknowns. A laptop that nobody remembers owning or a former employee’s phone that still receives company email is exactly the kind of risk an inventory should reveal.

Day 5: inventory important accounts

List the online services that could materially affect the business if an attacker gained control. Typical examples include:

• Primary email and productivity suite
• Domain registrar and DNS provider
• Website and hosting accounts
• Cloud storage
• Accounting and payroll
• Banking and payment services
• CRM and customer support tools
• Advertising and analytics platforms
• Social media accounts
• Source-code repositories
• Password managers
• Remote-access tools

For each account, record who owns it, who has administrator access, whether multi-factor authentication is enabled, what recovery email or phone is configured, and whether the account is shared.

Warning: never store passwords in this inventory spreadsheet. Store credentials in a reputable password manager and keep the inventory focused on ownership and access structure.

Day 6: inventory important data

Identify the information your company would struggle to replace or would be harmed by exposing. This may include customer records, employee information, contracts, invoices, accounting records, designs, source code, proposals, internal procedures, credentials, marketing assets, research, and backups.

For each category, answer four questions: where is it stored, who can access it, how sensitive is it, and how quickly would you need it after a disruption?

This step often reveals unnecessary duplication. For example, the same customer spreadsheet may exist in a shared drive, a personal laptop, an email attachment, and an old USB drive. More copies create more places to protect and more chances for outdated or sensitive information to escape.

Day 7: inventory vendors and outside access

Small businesses often rely on outside providers more heavily than large organizations. That makes vendor access part of your cybersecurity plan. List vendors that host data, process payments, manage your website, provide IT support, administer cloud accounts, or remotely access devices.

Record what each vendor can access, how you contact them during an incident, whether they support multi-factor authentication, and whether former vendors still have access. NIST’s 2026 supply-chain due-diligence guidance reinforces the importance of performing reasonable investigation before relying on suppliers for technology or services.

At the end of Day 7, your business should know what it owns, what it depends on, where important information lives, and which outside organizations can affect security. That is the minimum foundation for sensible controls.

Days 8–11: secure identities and access

Day 8: eliminate shared administrator accounts

Shared accounts make it difficult to know who changed a setting, downloaded data, or approved access. Where possible, give each person an individual account. Reserve administrator privileges for tasks that actually require them.

If a service forces your team to share a single login, protect it in a business password manager, limit who can retrieve it, enable multi-factor authentication, and document how access will be revoked when someone leaves.

Day 9: enable multi-factor authentication on the highest-impact accounts

Start with email, password managers, domain registrar accounts, cloud administration, banking, payroll, website administration, and any account that can reset access to other systems.

Prefer phishing-resistant options such as passkeys or hardware security keys where they are practical and supported. If those are unavailable, authenticator apps are generally a stronger choice than relying only on a password. SMS-based codes can still be better than password-only access in many situations, but businesses should understand that phone-number attacks and message interception can create additional risk.

Do not enable a new authentication method without thinking about recovery. Record approved recovery methods, store backup codes safely, and make sure the business—not only one employee’s personal phone—can recover critical accounts.

Day 10: implement a password-manager policy

A practical password policy has two goals: unique credentials and secure storage. Employees should not reuse business passwords across services, and they should not store credentials in spreadsheets, notes, chats, or unencrypted documents.

Select a password manager appropriate for your organization. Configure it so the business can recover access when an employee leaves, but do not give everyone access to every credential. Separate vaults or groups can limit exposure.

The main success metric is simple: after implementation, employees should no longer need to remember dozens of passwords or reuse them.

Day 11: remove unnecessary access

Review administrator lists, shared drives, cloud folders, website users, finance systems, advertising accounts, and remote-access tools. Remove users who no longer work with the company and reduce privileges that are no longer necessary.

Create an offboarding checklist for future departures. It should cover account suspension, shared credentials, device return, email forwarding decisions, cloud access, physical keys, vendor portals, and recovery contacts.

How to verify success: choose five important services at random. You should be able to explain who has access, why they have it, how they authenticate, and how you would remove them.

Days 12–15: harden devices and software

Day 12: turn on automatic updates where practical

FTC guidance for small businesses emphasizes keeping software current and installing security patches. Enable automatic updates for operating systems, browsers, office applications, mobile devices, routers, security tools, and commonly used software where business operations allow it.

For software that cannot update automatically, assign someone to check it on a schedule. Unsupported operating systems and abandoned applications should be placed on a replacement list because security fixes may no longer be available.

Day 13: secure laptops and phones

Require screen locks and strong device unlock methods. Turn on full-disk encryption where supported. Enable remote-locate or remote-wipe capabilities for company-owned mobile devices when appropriate. Avoid leaving devices unattended in vehicles or public places.

Physical security matters because losing an unencrypted laptop can become a data incident even if no hacker was involved.

Day 14: reduce unnecessary software and browser extensions

Every application and browser extension adds code, permissions, update requirements, and potential vulnerabilities. Remove software that employees no longer use. Pay special attention to remote-access tools, old VPN clients, browser extensions that can read website data, and utilities downloaded for one-time tasks.

On business-critical devices, prefer software from trusted sources and avoid giving employees local administrator privileges for routine work unless the role requires it.

Day 15: review your network basics

Change default router and network-device passwords. Update router firmware. Use modern Wi-Fi encryption supported by your equipment. Create a separate guest network for visitors and unmanaged devices where possible. Do not expose remote administration interfaces to the public internet unless you understand why it is necessary and how it is secured.

If your company relies on remote desktop or similar remote-access technology, review it carefully. FTC guidance notes that remote-access protocols can be abused by attackers. Limit access, require strong authentication, and disable remote access that is no longer needed.

Days 16–18: build backups you can actually recover from

Day 16: define what must be backed up

Backups should protect the information and systems your business cannot easily recreate. Make a list that includes important documents, databases, website files, accounting exports, customer records, configuration files, and any locally stored work product.

Cloud services do not automatically eliminate the need for backup planning. Understand what your provider protects, what it can restore, how long deleted items are retained, and whether account compromise could also affect stored copies.

Day 17: separate at least one backup from the normal environment

FTC ransomware guidance recommends regularly saving important files and maintaining backups that are not connected to the main network. The reason is straightforward: if attackers can reach both production data and every backup using the same credentials and network access, they may encrypt or delete both.

For a small business, separation might mean an offline drive rotated securely, a backup service with separate credentials and protected retention, an immutable-storage option, or another design that prevents routine user accounts from modifying all historical copies.

Day 18: test a restore

A backup is only useful if it can be restored. Choose a noncritical file, folder, database copy, or system snapshot and restore it into a safe location. Record how long it took and whether any permissions, file names, versions, or dependencies were missing.

Then schedule future restore tests. Quarterly may be appropriate for some businesses; high-change or high-impact systems may need more frequent testing.

Common mistake: checking that backup jobs report “success” but never testing recovery. A green status icon is not proof that the business can resume operations.

Days 19–21: reduce phishing and payment fraud risk

Employees need a repeatable way to question urgent messages, unexpected login requests, unusual attachments, and requests for money or credentials.

Day 19: teach one simple verification habit

Phishing works because it pushes people to act before verifying. FTC guidance recommends avoiding login links in unexpected messages and independently contacting the supposed sender when a request seems suspicious.

Create a company rule: requests involving passwords, money, bank-account changes, gift cards, payroll changes, or unusual file downloads must be verified through a second trusted channel when they are unexpected.

For example, if an email appears to come from a supplier asking to change payment details, do not confirm the change by replying to the message or calling a number contained in it. Use a known phone number or an established contact method.

Day 20: create a phishing-reporting path

Employees should know exactly where to send suspicious messages. Depending on company size, that might be a dedicated mailbox, an IT help-desk button, a chat channel, or a named person.

Make reporting easy and nonpunitive. If people fear embarrassment, they may hide clicks or suspicious events until damage becomes larger. The goal is early visibility, not punishment.

Day 21: strengthen email-domain protection

If your business owns its email domain, review SPF, DKIM, and DMARC with whoever manages your email and DNS. These technologies can help receiving systems evaluate whether messages claiming to come from your domain are authorized.

Do not change production email-authentication records blindly. Incorrect DNS records can interfere with legitimate mail. Inventory every legitimate sending service—your main email provider, newsletters, support systems, invoices, CRM tools, and transactional email—before tightening policies.

Days 22–24: add detection without building a security operations center

Day 22: decide what events deserve attention

A small business does not need to monitor every technical event. Start with signals that could indicate serious misuse:

• New administrator accounts
• Multi-factor authentication disabled
• Login from an unusual country or device
• Large downloads from shared storage
• Banking or payroll detail changes
• Unexpected email forwarding rules
• Security software disabled
• Multiple failed login attempts
• New remote-access software
• Website administrator changes

Turn on provider alerts for the services that support them. Route critical alerts to more than one responsible person so they are not missed when someone is away.

Day 23: preserve useful logs

Logs can help answer basic incident questions: who logged in, when an account changed, whether a file was downloaded, or which device accessed a service. Check retention settings for your most important cloud services and understand what your subscription includes.

You do not necessarily need indefinite log storage. You need enough history to investigate the incidents you are realistically likely to discover.

Day 24: create a weekly ten-minute security review

Pick a recurring time to review outstanding security alerts, failed backups, new accounts, departed users, overdue updates, and unresolved risks. For many small companies, ten focused minutes every week is more valuable than a large security project that happens once and is forgotten.

Days 25–27: prepare an incident response plan

Day 25: define what counts as an incident

Write examples that employees can recognize. An incident may include a stolen laptop, malware infection, compromised email account, ransomware message, unauthorized payment, exposed customer data, website takeover, lost credentials, suspicious administrator creation, or an employee sending sensitive information to the wrong recipient.

The definition should encourage early reporting. It is better to investigate a false alarm than to discover a genuine incident days later.

Day 26: write the first-hour checklist

When something serious happens, people often lose time deciding what to do. Create a short checklist that can be followed under pressure:

1. Record what was observed, when, and by whom.
2. Notify the designated incident owner.
3. Contain the problem without destroying evidence unnecessarily.
4. Protect unaffected accounts and systems.
5. Contact relevant technology providers.
6. Preserve logs, screenshots, emails, and timestamps.
7. Determine whether money, personal data, credentials, or critical operations are affected.
8. Escalate to legal, insurance, banking, law-enforcement, or specialist support when appropriate.

Do not write instructions that assume one type of incident fits every situation. Disconnecting a device may be sensible in one scenario and harmful in another. Your plan should clearly state when the team must stop improvising and contact a qualified incident-response professional.

Day 27: prepare contact information outside the compromised systems

Store emergency contact information somewhere you can access even if email or cloud storage is unavailable. Include your email provider, hosting company, domain registrar, bank fraud line, cyber-insurance contact if applicable, IT provider, legal counsel if you have one, and key business leaders.

For organizations that handle regulated information, research the notification duties that apply to your jurisdiction and industry before an incident occurs. Requirements vary significantly, so a generic internet checklist is not a substitute for appropriate legal guidance.

Days 28–30: recover, test, and turn the project into a routine

Day 28: write recovery priorities

Decide what the business must restore first. Email may be the highest priority for one company, while a point-of-sale system, production scheduling application, website, or customer database may be more urgent for another.

List systems in priority order and estimate how long the business can tolerate each being unavailable. These estimates do not need to be mathematically perfect. Their purpose is to guide restoration decisions when multiple systems are broken at the same time.

Day 29: run a tabletop exercise

Gather the people who would make decisions during an incident and walk through a realistic scenario. For example:

At 9:10 a.m., the finance manager reports that their email account is sending messages they did not write. At 9:20 a.m., a supplier says it received new bank details from that account. At 9:35 a.m., you discover an unfamiliar email-forwarding rule.

Ask: Who takes control? How do we secure the account? How do we verify whether payments changed? Which logs do we check? How do we contact affected suppliers? What if the attacker changed recovery information? Who communicates with staff? What evidence do we preserve?

The point of a tabletop exercise is not to “win.” It is to discover missing contacts, unclear authority, inaccessible backups, weak procedures, or assumptions that fail under stress.

Day 30: publish version 1.0 and create the next 90-day list

Finish the plan with a short prioritized backlog. Examples might include replacing two unsupported laptops, moving shared credentials into a password manager, enabling hardware security keys for administrators, testing website restoration, documenting vendor access, improving email authentication, or reviewing cyber-insurance options.

Assign each item an owner and target date. Then mark the plan as version 1.0 rather than “complete.” Cybersecurity is a management process, not a one-time installation.

A practical small-business cybersecurity policy you can actually enforce

Long policies often fail because employees do not read them. A small organization can begin with a concise set of rules that match real operations. The exact wording will vary, but the policy should answer the following questions clearly.

Who may create new software accounts?

Uncontrolled “shadow IT” can scatter business information across services nobody manages. Decide whether employees may create new SaaS accounts freely, need manager approval, or must use a defined procurement process. At minimum, the business should know where sensitive information is being stored.

Where may business files be stored?

Name approved storage locations. If employees are allowed to use local devices, personal cloud storage, USB drives, or personal email, define the conditions. If those methods are prohibited, provide a practical alternative or people will work around the rule.

What authentication is mandatory?

Specify which systems require multi-factor authentication and which authentication methods are approved. Apply stronger requirements to administrator, finance, domain, email, cloud, and password-manager accounts.

How are devices updated?

State whether updates install automatically, who handles exceptions, and what happens when a device or operating system reaches end of support.

How are suspicious messages reported?

Give one clear reporting path. Include what employees should do after clicking a suspicious link or entering credentials: report immediately, do not hide the mistake, and follow the containment instructions provided by the responsible person.

How are employees offboarded?

Access should be removed promptly when someone leaves. The checklist should include identity accounts, shared storage, finance systems, email, website access, VPN or remote access, code repositories, password-manager groups, physical devices, and vendor portals.

How to prioritize when your budget is extremely limited

Security spending can become confusing because vendors sell products for every imaginable threat. When money is limited, focus first on reducing high-probability, high-impact weaknesses.

A sensible priority order for many small businesses is:

1. Protect critical email, administrator, finance, and domain accounts with strong multi-factor authentication.
2. Use unique passwords stored in a managed password manager.
3. Patch supported software and replace unsupported systems.
4. Create separated backups and test restoration.
5. Remove former users and unnecessary administrator access.
6. Train employees to verify unusual requests involving credentials or money.
7. Secure remote access and network administration.
8. Turn on useful security alerts and preserve important logs.
9. Create and test an incident-response plan.
10. Evaluate additional security tools based on the risks you still have.

This order is not universal. A healthcare provider, manufacturer, school, financial service, or company holding sensitive regulated data may need additional controls, specialist advice, or compliance measures. The principle is to buy tools after understanding the risk they solve.

How to evaluate a cybersecurity vendor without becoming an expert

Many small businesses outsource part of their security. Outsourcing can be sensible, but responsibility does not disappear. Before hiring a provider, ask questions that reveal how the service works.

• Exactly what systems and risks will you manage?
• What is excluded?
• Who can access our systems?
• Do you use individual technician accounts and multi-factor authentication?
• How do you notify us about incidents?
• What logs and reports will we receive?
• How are backups protected and tested?
• How quickly can we reach a human during an emergency?
• What happens to our data and credentials when the contract ends?
• Which subcontractors or cloud providers are involved?

Be cautious when a vendor promises that a single product will make the company secure. Security depends on people, identity, devices, software, data, vendors, operations, and recovery. No dashboard can replace governance and basic discipline.

How to measure whether your plan is working

Metrics should help you make decisions, not create decorative reports. Start with measurements that are easy to collect and directly connected to risk.

Account protection

Measure the percentage of critical accounts protected by multi-factor authentication, the number of shared administrator accounts, and the number of former users still present in business systems.

Patch and device status

Track supported versus unsupported operating systems, overdue critical updates, unmanaged devices, and devices without encryption when encryption is required.

Backup reliability

Track successful backup jobs, failed jobs, date of the most recent restore test, and actual recovery time during tests.

Human reporting

Track whether employees know where to report suspicious activity and how quickly reports reach the responsible person. The goal is not to shame employees who make mistakes; it is to detect problems sooner.

Incident readiness

Track the age of emergency contacts, the date of the last tabletop exercise, unresolved incident-response gaps, and the time required to access critical provider contacts without relying on the normal email system.

Common mistakes that weaken otherwise good cybersecurity plans

Buying tools before building an inventory

You cannot protect systems you do not know exist. Asset and account inventory should come before complicated tooling.

Protecting employee passwords but ignoring recovery channels

An attacker may not need the password if they can take over the recovery email, phone number, or administrator account. Review the full recovery chain for critical services.

Assuming cloud services remove backup responsibility

Cloud providers improve resilience, but deletion, account compromise, configuration mistakes, retention limits, and application-level problems can still cause data loss. Understand the provider’s actual recovery capabilities.

Training employees once per year and calling it complete

Threats and workflows change. Short, recurring reminders tied to real situations are more useful than a once-a-year slide deck nobody remembers.

Keeping every employee as an administrator

Excess privileges increase the damage a compromised account can cause. Give people the access required for their role and review it regularly.

Failing to test the response plan

An untested plan may contain dead phone numbers, inaccessible credentials, ambiguous authority, or backup procedures that do not work. Tabletop exercises reveal these problems before a real emergency.

A 30-minute quarterly cybersecurity review

After the initial 30-day project, keep momentum with a compact quarterly review. Gather the owner, operations lead, and whoever handles IT or security. Review the following:

• New employees, contractors, systems, and vendors
• Departed users and removed access
• Critical accounts without multi-factor authentication
• Unsupported devices or applications
• Backup failures and restore-test results
• Major security alerts and suspicious activity
• Changes to payment or banking workflows
• Website, domain, and email administration
• Open security risks from the previous quarter
• Incident-response contacts and escalation paths

Then choose no more than three priorities for the next quarter. A short list that gets completed is more valuable than fifty unowned recommendations.

How to handle personal devices and remote work without creating a security gap

Many small businesses allow employees to use personal phones or computers because it is convenient and inexpensive. That can work, but only if the business decides what is acceptable instead of letting every employee invent a different security model. Begin by identifying which business systems can be accessed from personal devices and which data can be downloaded locally. If a phone is used only for multi-factor authentication, the risk is very different from a personally owned laptop that stores customer records, accounting files, and saved browser sessions.

Create a short bring-your-own-device rule. Require supported operating systems, a screen lock, timely updates, device encryption where available, and immediate reporting if the device is lost or stolen. Decide whether the business may remotely remove company data from managed applications. If you cannot technically separate business and personal information, limit the type of sensitive data that can be stored on the device.

Remote workers also need a safe way to reach company systems. Avoid telling employees to expose a home computer or office workstation directly to the internet. Use the remote-access method approved by your business or service provider, require multi-factor authentication, and remove access when it is no longer needed. If employees work from public Wi-Fi, teach them not to ignore browser certificate warnings or security prompts simply because they are trying to connect quickly.

Think about privacy as well as security. A company should not collect more information from an employee’s personal device than it genuinely needs. If stronger control is necessary, supplying a company-owned device can be clearer for both sides. The cost of a managed laptop may be justified when the role handles sensitive information, financial approvals, source code, customer data, or administrative access.

A useful compromise for growing businesses is to define three access levels. Low-risk services, such as a public scheduling tool, may be available from ordinary personal devices. Medium-risk services may require a managed browser, application, or stronger authentication. High-risk systems—such as payroll administration, domain management, production infrastructure, or sensitive customer databases—may be restricted to company-controlled devices.

Do not forget home networking basics. Employees should change default router passwords, install firmware updates when available, use current Wi-Fi encryption supported by their equipment, and avoid sharing the same wireless password indefinitely with visitors. These steps do not turn a home network into an enterprise environment, but they reduce unnecessary exposure.

Finally, design remote-work security around failure. Ask what happens if an employee’s phone is lost during travel, a laptop is stolen, a home router fails, or a password manager becomes temporarily unavailable. The employee should know whom to contact, how access can be revoked, and how work can continue using an approved alternative. A plan that only works when every device is present and every service is online is not resilient enough.

Portable devices need both digital safeguards and basic physical protection, especially when employees work away from a fixed office.

Frequently asked questions

Does a small business really need a formal cybersecurity plan?

It needs a documented plan proportional to its size and risk. That document can be concise, but it should define ownership, important assets, access rules, backup practices, incident reporting, and recovery priorities. Documentation becomes especially valuable when the business adds employees or vendors because security can no longer depend on one person’s memory.

Is antivirus enough for a very small company?

No single control is enough. Endpoint protection may be useful, but it does not replace account security, updates, backups, access management, phishing resistance, secure configuration, vendor management, and incident planning.

Should every employee use multi-factor authentication?

Businesses should enable it broadly where supported, with highest priority on email, administrative, finance, cloud, password-manager, and domain accounts. Authentication strength should reflect the impact of account compromise.

How often should backups be tested?

The right interval depends on how frequently data changes and how costly downtime would be. The essential point is that restore testing must be scheduled, repeated, and documented. A company that cannot remember its last successful restore test should treat that as an unresolved risk.

What is the first thing to do after a suspected email compromise?

Notify the designated incident owner immediately and begin the company’s containment process. Typical actions may include securing the account, reviewing sessions and recovery methods, checking forwarding rules and administrative changes, preserving relevant logs, and assessing whether messages, payments, or other accounts were affected. Exact actions depend on the provider and incident, so use vendor guidance and professional help when needed.

How much should a small business spend on cybersecurity?

There is no universal percentage that fits every business. Spending should follow risk. A company handling sensitive information, processing substantial payments, or relying on always-available systems may rationally spend more than a low-complexity business. Start by identifying high-impact risks and fund controls that materially reduce them.

Can we complete this plan without an IT employee?

Many governance, inventory, access, training, backup, and incident-planning steps can be started by a business owner or operations manager. Technical implementation may require support from providers or qualified consultants, especially for network configuration, email authentication, complex cloud environments, regulated data, or incident response.

Sources and further reading

• NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
• NIST Small Business Quick-Start Guides
• NIST Cybersecurity Basics for Small Business
• Federal Trade Commission: Cybersecurity for Small Business
• NIST: Cybersecurity Supply Chain Risk Management Due Diligence Quick-Start Guide, July 8, 2026

Final step: make security part of normal business operations

The most important result of this 30-day project is not the document itself. It is the operating habit behind it. Your business should know what it depends on, who owns security decisions, which accounts deserve the strongest protection, how backups are restored, how employees report suspicious activity, and what happens in the first hour of an incident.

Start with the controls that reduce the greatest practical risk. Avoid the common mistake of buying sophisticated tools while basic accounts remain unprotected, former users still have access, backups are untested, or nobody knows who makes decisions during an emergency.

Your first action today should be simple: name the person accountable for the cybersecurity plan and create the asset-and-account inventory. Once those two pieces exist, every later decision becomes more concrete. The biggest mistake to avoid is treating cybersecurity as a one-time technology purchase. It is an ongoing business-management process that should evolve as your people, systems, vendors, and risks change.