Cybersecurity for Small Business: The 15 Controls That Matter

Good cyber security for small business is a short list, not a product catalog. Most incidents that hit smaller companies come through a handful of doors: a phishing email, a reused password, an unpatched system, an exposed remote-desktop port, a backup that was never tested. The fifteen controls below close those doors.

None of them requires a security team, most are included in the Microsoft 365 or Google Workspace plan you already pay for, and together they answer nearly every question on a cyber insurance application or a customer security questionnaire. Work through them in the order given and you will be ahead of most companies your size. This is general information, not legal advice.

The threats that actually hit small businesses

Attackers do not target small companies because they are interesting. They target them because automated tools find weak doors at scale, and a small company is less likely to notice. The patterns repeat:

• Phishing and business email compromise. A convincing email, a fake login page, and an attacker is inside a mailbox reading invoices and waiting for the right moment to redirect a payment.
• Ransomware. Usually arrives through phishing, a stolen password or an exposed remote-access service, encrypts everything it can reach, and increasingly steals data first to add extortion to the demand.
• Reused and leaked passwords. A password used on a breached shopping site is tried against your email, your accounting software and your cloud console within hours of the leak.
• Payment fraud. A “changed bank details” email from a supplier, or from your own CEO, timed for a Friday afternoon.
• Unpatched systems and exposed services. Old firewalls, forgotten web servers, remote desktop open to the internet, and software that reached end of support years ago.
• Lost and stolen devices. An unencrypted laptop in a car is a data breach, not an inconvenience.
• Ex-employees and vendors. Accounts that were never disabled, shared logins, and suppliers with more access than they need.

Cyber security for small business: the 15 controls

Each control below says what to do, why it matters and what “done” looks like. They follow the priorities in the NIST Small Business Cybersecurity Corner and Implementation Group 1 of the CIS Controls, translated into tasks.

1. Multi-factor authentication everywhere. Start with email, remote access, cloud consoles, banking and anything with administrator rights, then extend to every account that supports it. Prefer app-based or hardware keys over SMS. Done: no account without MFA, enforced by policy rather than user choice.
2. A password manager and unique passwords. Give every employee a company password manager, require unique passwords for every account, and retire the spreadsheet. Done: shared logins eliminated or vaulted with named access.
3. Patch everything, automatically. Operating systems, browsers, office software, phones, firewalls and the line-of-business application nobody wants to touch. Turn on automatic updates and check monthly that they ran. Done: a list of every system and its patch status, reviewed monthly.
4. Backups you have restored. Three copies, on two different media, one offline or immutable so ransomware cannot encrypt it. Include cloud services such as mailboxes and shared drives, which are not backed up by default in the way most people assume. Done: a restore test, documented, within the last quarter.
5. Email security. Publish SPF, DKIM and DMARC records so your domain cannot be easily spoofed, turn on the advanced phishing and attachment filtering in your mail platform, and tag external messages. Done: DMARC at an enforcing policy; external-sender banner on.
6. Endpoint protection on every device. Modern endpoint detection and response (EDR), not just signature antivirus, on every laptop, desktop and server, managed centrally so you can see alerts. Done: console shows every device, none unprotected.
7. Remove local administrator rights. Daily accounts should not be able to install software or change system settings. Give administrators a separate account for administrative work. Done: no one uses an admin account for email or browsing.
8. Encrypt laptops and phones. Turn on BitLocker or FileVault on every computer and enforce device encryption, PIN and remote wipe on phones through mobile device management. Done: a lost device is a replacement cost, not a breach.
9. Secure remote access. Close remote desktop and other administrative ports to the internet. Use a VPN or a zero-trust access service with MFA. Done: an external scan shows nothing listening that should not be.
10. Network basics. A supported firewall with current firmware, a separate guest Wi-Fi, WPA2 or WPA3 with a long passphrase, and smart devices (printers, cameras, thermostats) on their own network segment. Done: equipment list with end-of-support dates, nothing past them.
11. Inventory and offboarding. Keep a list of every device, every SaaS application and every account, with an owner. Use an offboarding checklist that disables access the day someone leaves. Done: quarterly review of accounts against the current staff list.
12. Logging and alerts. Turn on the audit logs in Microsoft 365 or Google Workspace, keep them as long as your plan allows, and set alerts for impossible-travel sign-ins, new mailbox forwarding rules and new administrator accounts. Done: someone receives and reads the alerts.
13. Security awareness training. Short, regular training on phishing, payment fraud and safe handling of data, with simulated phishing to measure it. Done: everyone trained at hire and at least yearly, records kept.
14. Payment and vendor verification. A written rule that any change to bank details or any unusual payment request is verified by a phone call to a known number, never by replying to the email. Done: finance staff can recite the rule.
15. An incident response plan. One page: who to call (internal lead, IT provider, insurer, lawyer), how to isolate a device, where the backups are, what to tell staff and customers, and where to log what happened. Done: the plan is printed, because the incident may take your email down.

Write the fifteen into a policy set so they survive staff changes; our guide to IT policies and procedures shows the ten documents most companies need.

Order of operations

Doing fifteen things at once is how nothing gets finished. Sequence them by impact and effort.

Phase	Controls	Why this order
Week one	1 MFA, 4 backups (at least verify one restore), 9 close exposed remote access, 14 payment verification rule	These stop the attacks that end companies: account takeover, ransomware with no recovery, and wire fraud
Month one	2 password manager, 3 patching, 5 email security, 6 endpoint protection, 8 device encryption	Each closes a common entry point and most are configuration, not purchases
Quarter one	7 remove admin rights, 10 network basics, 11 inventory and offboarding, 12 logging and alerts, 13 training, 15 incident plan	These need a little planning and some habits, and they turn the first ten into a program rather than a one-off
Ongoing	Quarterly: restore test, access review, patch check, phishing simulation. Yearly: risk assessment, policy review, insurance renewal evidence	Security decays without a calendar

Before the quarter is out, run a short IT risk assessment. It will tell you whether your company has risks outside this list (a custom application, a regulated data set, an industrial system) that need their own controls.

What cyber insurance applications ask for

Insurers have learned which controls predict claims, and application forms now read like a checklist of the list above. Expect questions on:

• MFA on email, remote access and privileged accounts (often a condition of coverage)
• Endpoint detection and response on all devices
• Backups that are offline or immutable, encrypted, and tested, with the test date
• Email filtering and anti-spoofing (SPF, DKIM, DMARC)
• Patch management cadence and whether any end-of-support software is in use
• Security awareness training and phishing simulation frequency
• Privileged access management and removal of local admin rights
• A written incident response plan and business continuity plan
• Encryption of data at rest on devices and in the cloud
• Vendor and remote-access controls for third parties

Answer accurately. An application is a representation, and a claim can be contested if the controls you described were not actually in place when the incident happened. If an answer is “no” today, the fix is usually on the list above and often costs less than the higher rate you would otherwise pay.

Where PS3G fits

PS3G provides cybersecurity services for small business and for larger organizations with the same method: an assessment against this list and your actual risks, a prioritized plan, and hands-on help implementing it. Our cybersecurity consulting covers the assessment, policies, training and the questionnaire or insurance evidence you need. If you would rather not run the controls yourself, our managed professional services handle patching, monitoring, backups, access reviews and reporting under defined SLAs, scaled to a five-person office or a multi-site company.

Related reading

• IT Policies and Procedures: The 10 Every Company Needs
• IT Risk Assessment Template: How to Run One in a Week
• NIST Cybersecurity Framework Explained for Smaller Companies
• Cybersecurity consulting and information security services

Frequently asked questions

What are the most important cybersecurity best practices for small businesses?

Multi-factor authentication on every account, backups that you have actually restored, automatic patching, email security with DMARC, endpoint protection on every device, and a verification rule for payments. Those six stop the common attacks: account takeover, ransomware, and invoice fraud. The remaining controls on this list turn those fixes into a program that survives staff turnover and satisfies insurers and customers.

Do small businesses really get targeted by hackers?

Yes, mostly by automated tools rather than by someone choosing you. Password-stuffing bots, phishing kits and scanners for exposed remote-desktop ports run against every domain and address range they can find. A small company with weak controls is simply easier to compromise than a large one with a security team, and the payout from a redirected invoice or a ransom is still worth the attacker’s time.

How much should a small business spend on cybersecurity?

Less than most fear, if the money goes to the right things. The first ten controls are mostly configuration of services you already have, a password manager, endpoint protection and a backup service. The larger costs are time and discipline. A short risk assessment tells you whether your business has risks beyond the basic list that justify more, which is a better guide than any percentage-of-revenue rule.

Do I need cybersecurity services for small business, or can I do this myself?

A capable owner or office manager can implement most of the fifteen controls with the vendor documentation and a weekend. Outside help is worth it when nobody has the time, when you need an independent assessment for a customer or insurer, when you handle regulated data such as health or payment information, or when you want someone to run the controls month after month instead of hoping they stay on.

Is cyber insurance worth it for a small company?

For most companies it is a sensible part of the plan, provided the controls on the application are real. Insurance pays for response costs, legal help and business interruption after an incident; it does not prevent one, and insurers are declining or limiting coverage for companies without MFA, EDR and tested backups. Put the controls in first, then insure what remains.