Cyber Insurance Renewal Calendar: What to Fix 90, 60, and 30 Days Before Renewal
A practical 90/60/30-day cyber insurance renewal calendar for small businesses that need cleaner answers, better evidence, and fewer last-minute surprises.
Read articleEndpoint & Detection
Small Business Cybersecurity Basics: 10 Things to Do This Week
A plain-English small business cybersecurity checklist — the ten controls most worth doing first, before you spend a dollar on tools you may not need yet.
SMB
If you have one week to improve your small business cybersecurity, spend it on the controls that cut real fraud, account takeover, and ransomware risk fast: MFA, tested backups, software updates, admin cleanup, and a written process for suspicious money requests. Skip the shopping trip.
That order beats chasing a tool stack first, and it is not just our opinion. The FTC's small-business cybersecurity guidance and NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide push the same idea: understand what the business depends on, protect the essentials, and make security part of routine operations — not a once-a-year project.
Why this matters now
Small businesses get hit because they are easier to pressure, easier to spoof, and least likely to have someone watching when something goes wrong.
The tactics that drain a Fortune 500 — phishing, invoice and wire fraud, account takeover, extortion — scale down cleanly to a ten-person shop. The difference is the blast radius: a six-figure loss is a bad quarter for a large company and an extinction event for a small one. That asymmetry is exactly why the FTC and the FBI run small-business-specific programs. This checklist is the operational version of that guidance.
1. Turn on MFA for the accounts that can reset everything else
Start with the accounts that hold the keys:
- Primary business email
- Microsoft 365 or Google Workspace admin accounts
- Accounting and banking platforms
- Payroll
- Your password manager
- Your backup console
If a criminal gets one of these, they usually do not need malware to hurt you. They reset logins, reroute invoices, or quietly take over a mailbox. A password alone is no longer a control on accounts that can move money or reset other accounts — turn on multi-factor authentication everywhere on that list this week.
2. Update software and turn on automatic updates where possible
Outdated software is still one of the easiest ways into a business — boring advice because it still works.
Make a one-page list:
- Operating systems
- Browsers
- Firewall and router firmware
- Business-critical apps
- Remote-access tools
Then turn on auto-update everywhere you reasonably can, and put a recurring reminder on the few things that cannot update themselves.
3. Confirm backups exist — and that you can actually restore them
A backup you have never tested is a theory, not a control.
At minimum, write down:
- What business data matters most
- Where it is backed up
- How often
- Who can restore it
- How long a full restore takes
If any answer is vague, that is the gap to close this week. This is also the single fastest place to look unprepared to a cyber-insurance underwriter — our breakdown of what controls cyber insurers require in 2026 explains why, and the free Cyber Insurance Readiness Questionnaire scores your backups the way a carrier will.
4. Lock down admin access
Too many small businesses run on shared admin accounts, leftover contractor logins, and staff who have more access than their job needs.
This week:
- List every admin account
- Remove the ones no longer needed
- Separate daily-use accounts from admin accounts
- Confirm MFA is on for every admin login
Inventory and role clarity beat security maturity you have not earned yet. This is the cleanest place to apply that.
5. Make invoice and payment verification a written rule
Most small-business losses do not start with ransomware. They start with someone believing an email.
Urgency, impersonation, and an unusual payment method are the recurring shape of payment fraud. If the person who pays your bills can be rushed, the business is exposed. You want one short, non-negotiable rule:
No payment-change request, bank-detail change, or urgent invoice gets approved from the first email alone. Confirm it on a known phone number, every time.
That one control stops a surprising amount of damage, and it costs nothing.
6. Train staff on suspicious email, texts, and calls
You do not need a giant annual module to make progress this week. Give the team a five-minute briefing on the patterns that actually land:
- Fake invoice and payment-change emails
- Login-reset and MFA-fatigue lures
- Urgent messages claiming to be "the boss"
- Tech-support pop-ups and callbacks
- Vendor or government impersonation
When you are ready for the operating version, our guide to a real phishing training program for small business covers what good looks like.
7. Check remote access and remove what you do not need
Remote access is convenient, and lazy remote access is dangerous.
This week, find:
- Exposed remote desktop (RDP)
- Old or unused VPN accounts
- Support tools left installed after a one-time fix
- Unmanaged personal devices with business access
If you do not know what is exposed, that is itself the finding — it means the environment needs a cleanup pass before anything else.
8. Verify endpoint protection is actually deployed everywhere
Do not assume the business is protected because "we have antivirus." Ask the stricter question:
Is every workstation and every server that matters actually covered, current, and monitored — by someone who will respond?
That last clause is the one that gets skipped, and it is the whole game. It is also why buyers get stuck between labels like EDR, MDR, and XDR. Our EDR vs MDR vs XDR buyer's guide is the next step when you are choosing that layer.
9. Know what you would do in the first hour of an incident
Every business should be able to answer, on demand:
- Who gets called first
- Who can isolate a machine or disable an account
- Where critical vendor and insurance contacts live
- How leadership gets informed
- How the business keeps running if email is down
If you do not have a real answer, write a one-page incident note this week. It does not need to be elegant; it needs to exist. For the first-day version, the first 24 hours after a ransomware scare is the practical follow-on.
10. Make one person own the checklist
Cybersecurity dies in shared ownership.
Even in a tiny business, one named person needs to own the checklist, the follow-ups, and the next review date. They do not need to be a full-time security lead — they need the authority to push basic controls through. Security is an operating responsibility, not an annual technical chore.
The fastest version, if you are already underwater
If this week is already a mess, do these five and stop:
- MFA on email, bank, payroll, and admin accounts
- Confirm backups and prove one restore path
- Remove stale admin access
- Write the payment-verification rule
- Brief staff on suspicious requests
That is not perfect security. It is meaningful risk reduction, and it is achievable in an afternoon.
What not to do first
Do not start by buying the most expensive product you can find. Do not start by writing a sixty-page policy nobody will read. And do not start by assuming your IT contractor, your MSP, or your antivirus vendor already has this handled — unless you have verified it in writing.
The right first week is about clarity and control, not cosmetics.
Where to go from here
The best small-business cybersecurity basics are the ones that stop common failures before they get expensive: MFA, updates, tested backups, admin cleanup, payment verification, and a real reporting path for suspicious activity. Do those first, then decide whether you need a more mature detection-and-response layer, a formal compliance program, or outside help. Businesses get into trouble when they reverse that order.
If you would rather not work the list alone:
- Start free — the 2026 Cyber Insurance Readiness Questionnaire is this checklist, scored against the exact controls underwriters and attackers check first.
- Regulated vertical? Dental, law, accounting, real estate, financial services and more each have a program tuned to their specific risk and rules.
- Want it run for you? The Cyber Insurance Readiness Sprint turns this list into a documented, evidence-backed program in a fixed scope — no long contract to find out if we are the right fit.
Obsidian Ridge is a managed cybersecurity practice. We operate the controls above end-to-end, so a small team never has to choose between doing security and doing the actual job.
Last updated
June 10, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Questions readers usually ask next
What are the most important cybersecurity basics for a small business?
Start with MFA on the accounts that can reset everything else, tested backups, software updates, admin-account cleanup, written payment-verification, basic staff awareness, and a one-page plan for the first hour of an incident. Those operational basics reduce a large share of common small-business risk before you buy a single tool.
Do small businesses really get targeted?
Yes. Attackers use the same fraud, phishing, and account-takeover tactics against a ten-person company that they use against a large enterprise — and a loss that a big company absorbs can end a small one. The FTC and NIST both publish security guidance written specifically for small businesses for exactly that reason.
Do I need to buy expensive tools first?
Not usually. Most of the most useful first steps are operational, not purchased: turning on MFA, testing a backup restore, cleaning up admin access, and teaching people how to verify a suspicious request. Buy the detection-and-response layer after the basics are in place, not before.
Is antivirus enough for a small business?
No. Basic malware protection helps, but it does not stop the account takeovers, invoice fraud, and identity-layer attacks that drive most small-business losses. It does not replace MFA, backups, payment verification, or a response plan.
What should I fix first if I only have one week?
Protect the accounts that matter most with MFA, confirm you can actually restore a backup, tighten who has admin access, write a payment-verification rule, and brief staff on suspicious requests. That is meaningful risk reduction in five moves.
Related reading
Keep going
Backups Are Not Recovery: How to Prove You Can Restore Before Ransomware
A practical restore-testing guide for small businesses that need to prove backups will actually support recovery before ransomware, an outage, or an insurer asks.
Read articleThe cheapest MDR for small business: real 2026 pricing by endpoint count
A pricing-first look at small-business MDR in 2026, using only public vendor pricing where it actually exists and showing how endpoint minimums change the math.
Read article