Security that fits the business
Cybersecurity basics every small business needs
A plain-language security operating model for small teams, customer data, vendors, and recovery.
The big picture
Protection works in layers.
Small-business security works when controls follow business operations. Know the critical services, limit access, train for likely scenarios, and rehearse how the company will continue after an incident.
Business resilience depends on supported security controls, careful vendor choices, and a rehearsed response plan. Explore Cybersecurity tools & services, Security tools, checklists & protection kits, and AI privacy & protection.
- 01
Inventory critical accounts, data, and vendors
- 02
Require MFA and least privilege
- 03
Maintain isolated, tested backups
- 04
Write and rehearse an incident plan
Private, in-browser check
Business readiness pulse
Answer four quick prompts. The result stays in this tab and points you to a relevant guide.
Hub & spoke library
Follow the full pathway.
Start with the guide closest to your situation. Each spoke returns here so you can move from immediate action to long-term protection.
Small-business cyber risks
Prioritize likely business losses across email, credentials, vendors, devices, data, and availability.
Small-business security policy
Write a short policy people can follow for access, devices, data, vendors, incidents, and exceptions.
Employee security training
Build short, role-based practice around the messages and decisions staff actually face.
Ransomware readiness
Reduce the blast radius and recoverability impact of encryption, theft, extortion, and operational disruption.
Protecting customer data
Minimize collection, map access, encrypt appropriately, manage retention, and prepare transparent response.
Backup & recovery planning
Design recovery around business services, clean copies, restoration time, and tested dependencies.
PCI compliance basics
Understand the responsibilities around payment-card environments while reducing the systems that touch card data.
At a glance
A working model
Use this table to connect the control to the result and the moment it needs attention.
| Layer | What it changes | When to use it |
|---|---|---|
| Email and identity | Invoice fraud; account takeover | MFA, roles, verification rules |
| Customer data | Breach and compliance impact | Minimize, encrypt, control access |
| Operations | Ransomware or outage | Tested recovery and manual fallback |
| Suppliers | Third-party compromise | Due diligence and offboarding |