Getting the basics right with small business cybersecurity

If you run a small business, it can be difficult to know where to start with cybersecurity. You’re already busy running the business, and much of the advice can feel overly technical.

NIST’s new guide is useful here. It’s written for people running businesses on their own, including freelancers and independent consultants. It explains the basics, why they matter and what you can do, without expecting you to be a security expert.

What I like about it is that the advice gives you somewhere sensible to start.

• Make a list of the accounts, devices and services you rely on, along with the important information you hold. Think about how losing access to them would affect your work.
• Protect your accounts with passkeys where available. Where you use passwords, make them strong and unique, and switch on multi-factor authentication for an extra check when signing in.
• Keep your devices and software updated. Automatic updates can help, but you also need to know when something is too old to receive security updates.
• Back up important information and check that you can restore it. Finding out that a backup doesn’t work when you need it is too late.
• Switch on alerts for account logins and payments. If someone unexpectedly asks you to change payment details, check with them using a phone number you already trust.
• Work out who you would contact if something went wrong and how you could keep the business running. Keep a copy of those details somewhere you can access even if your email is unavailable.

Think about what would happen if you couldn’t access your email, take payments or open your customer files. Start with whichever would have the biggest impact on your business, and check what you have in place to protect it and recover access.

The guidance gives you a starting point. What else you need will depend on your business, the information you handle and your commitments to customers.

This is how I approach the work at Kurosec. Understand the business, focus on what matters and help put sensible protections in place. If you’re unsure where to start, we can talk it through.