Small Business Cybersecurity Basics: 10 Things to Do This Week

If you have one week to improve your small business cybersecurity, spend it on the controls that cut real fraud, account takeover, and ransomware risk fast: MFA, tested backups, software updates, admin cleanup, and a written process for suspicious money requests. Skip the shopping trip.

That order beats chasing a tool stack first, and it is not just our opinion.

The FTC's small-business cybersecurity guidance and NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide push the same idea: understand what the business depends on, protect the essentials, and make security part of routine operations — not a once-a-year project.

Why this matters now

Small businesses get hit because they are easier to pressure, easier to spoof, and least likely to have someone watching when something goes wrong.

The tactics that drain a Fortune 500 — phishing, invoice and wire fraud, account takeover, extortion — scale down cleanly to a ten-person shop. The difference is the blast radius: a six-figure loss is a bad quarter for a large company and an extinction event for a small one.

That asymmetry is exactly why the FTC and the FBI run small-business-specific programs. This checklist is the operational version of that guidance.

1. Turn on MFA for the accounts that can reset everything else

Start with the accounts that hold the keys:

• Primary business email
• Microsoft 365 or Google Workspace admin accounts
• Accounting and banking platforms
• Payroll
• Your password manager
• Your backup console

If a criminal gets one of these, they usually do not need malware to hurt you. They reset logins, reroute invoices, or quietly take over a mailbox.

A password alone is no longer a control on accounts that can move money or reset other accounts — turn on multi-factor authentication everywhere on that list this week.

2. Update software and turn on automatic updates where possible

Outdated software is still one of the easiest ways into a business — boring advice because it still works.

Make a one-page list:

• Operating systems
• Browsers
• Firewall and router firmware
• Business-critical apps
• Remote-access tools

Then turn on auto-update everywhere you reasonably can, and put a recurring reminder on the few things that cannot update themselves.

3. Confirm backups exist — and that you can actually restore them

A backup you have never tested is a theory, not a control.

At minimum, write down:

• What business data matters most
• Where it is backed up
• How often
• Who can restore it
• How long a full restore takes

If any answer is vague, that is the gap to close this week.

This is also the single fastest place to look unprepared to a cyber-insurance underwriter — our breakdown of what controls cyber insurers require in 2026 explains why, and the free Cyber Insurance Readiness Questionnaire scores your backups the way a carrier will.

4. Lock down admin access

Too many small businesses run on shared admin accounts, leftover contractor logins, and staff who have more access than their job needs.

This week:

• List every admin account
• Remove the ones no longer needed
• Separate daily-use accounts from admin accounts
• Confirm MFA is on for every admin login

Inventory and role clarity beat security maturity you have not earned yet. This is the cleanest place to apply that.

5. Make invoice and payment verification a written rule

Most small-business losses do not start with ransomware. They start with someone believing an email.

Urgency, impersonation, and an unusual payment method are the recurring shape of payment fraud. If the person who pays your bills can be rushed, the business is exposed. You want one short, non-negotiable rule:

No payment-change request, bank-detail change, or urgent invoice gets approved from the first email alone. Confirm it on a known phone number, every time.

That one control stops a surprising amount of damage, and it costs nothing.

6. Train staff on suspicious email, texts, and calls

You do not need a giant annual module to make progress this week. Give the team a five-minute briefing on the patterns that actually land:

• Fake invoice and payment-change emails
• Login-reset and MFA-fatigue lures
• Urgent messages claiming to be "the boss"
• Tech-support pop-ups and callbacks
• Vendor or government impersonation

When you are ready for the operating version, our guide to a real phishing training program for small business covers what good looks like.

7. Check remote access and remove what you do not need

Remote access is convenient, and lazy remote access is dangerous.

This week, find:

• Exposed remote desktop (RDP)
• Old or unused VPN accounts
• Support tools left installed after a one-time fix
• Unmanaged personal devices with business access

If you do not know what is exposed, that is itself the finding — it means the environment needs a cleanup pass before anything else.

8. Verify endpoint protection is actually deployed everywhere

Do not assume the business is protected because "we have antivirus." Ask the stricter question:

Is every workstation and every server that matters actually covered, current, and monitored — by someone who will respond?

That last clause is the one that gets skipped, and it is the whole game. It is also why buyers get stuck between labels like EDR, MDR, and XDR. Our EDR vs MDR vs XDR buyer's guide is the next step when you are choosing that layer.

9. Know what you would do in the first hour of an incident

Every business should be able to answer, on demand:

• Who gets called first
• Who can isolate a machine or disable an account
• Where critical vendor and insurance contacts live
• How leadership gets informed
• How the business keeps running if email is down

If you do not have a real answer, write a one-page incident note this week. It does not need to be elegant; it needs to exist.

For the first-day version, the first 24 hours after a ransomware scare is the practical follow-on.

10. Make one person own the checklist

Cybersecurity dies in shared ownership.

Even in a tiny business, one named person needs to own the checklist, the follow-ups, and the next review date.

They do not need to be a full-time security lead — they need the authority to push basic controls through. Security is an operating responsibility, not an annual technical chore.

The fastest version, if you are already underwater

If this week is already a mess, do these five and stop:

1. MFA on email, bank, payroll, and admin accounts
2. Confirm backups and prove one restore path
3. Remove stale admin access
4. Write the payment-verification rule
5. Brief staff on suspicious requests

That is not perfect security. It is meaningful risk reduction, and it is achievable in an afternoon.

What not to do first

Do not start by buying the most expensive product you can find. Do not start by writing a sixty-page policy nobody will read. And do not start by assuming your IT contractor, your MSP, or your antivirus vendor already has this handled — unless you have verified it in writing.

The right first week is about clarity and control, not cosmetics.

Where to go from here

The best small-business cybersecurity basics are the ones that stop common failures before they get expensive: MFA, updates, tested backups, admin cleanup, payment verification, and a real reporting path for suspicious activity.

Do those first, then decide whether you need a more mature detection-and-response layer, a formal compliance program, or outside help. Businesses get into trouble when they reverse that order.

If you would rather not work the list alone:

• Start free — the 2026 Cyber Insurance Readiness Questionnaire is this checklist, scored against the exact controls underwriters and attackers check first.
• Regulated vertical? Dental, law, accounting, real estate, financial services and more each have a program tuned to their specific risk and rules.
• Want it run for you? The Cyber Insurance Readiness Sprint turns this list into a documented, evidence-backed program in a fixed scope — no long contract to find out if we are the right fit.

Obsidian Ridge is a managed cybersecurity practice. We operate the controls above end-to-end, so a small team never has to choose between doing security and doing the actual job.