Most breaches at small organizations start with a stolen password, a phishing email or an unpatched device. These seven controls close the most common gaps without a big-company budget.
Small businesses are not too small to be targeted. Attackers automate their work, so they go after whoever is easiest to get into, and that is often an organization with no dedicated IT staff. The good news is that most successful attacks exploit a short list of gaps. Close these seven and you remove the easy paths in.
Stolen and reused passwords are the most common way into business accounts. Multi-factor authentication (MFA) stops the majority of those attempts, because a password alone is no longer enough. Start with email and Microsoft 365 or Google Workspace, then banking, payroll, your accounting software and any remote access tools. Prefer an authenticator app or passkeys over text-message codes wherever you can.
Traditional antivirus looks for known bad files. Modern attacks often use legitimate tools already on the computer, so they slip past signature-based scanning. Endpoint detection and response (EDR) watches behavior instead, flags suspicious activity like mass file encryption, and can isolate a device automatically. Paired with a team that monitors alerts around the clock, it's one of the highest-value controls you can add.
Unpatched software is an open invitation. Set Windows, macOS, browsers and common business applications to update automatically, and have someone verify that updates actually installed. Don't forget the network: firewalls, routers and Wi-Fi access points need firmware updates too, and they're the devices most often forgotten.
Keep at least three copies of important data, on two different types of storage, with one copy offsite and ideally immutable so ransomware can't encrypt or delete it. Remember that Microsoft 365 and Google Workspace data needs its own backup; the built-in retention is not a full backup strategy. Most importantly, test a restore every quarter. A backup you have never restored is a guess.
Email is still the front door for phishing and invoice fraud. Configure SPF, DKIM and DMARC on your domain so criminals can't easily spoof your address. Add advanced filtering that scans links and attachments, and set a firm rule that any change to payment or banking details is confirmed by phone using a number you already have on file.
Your team is part of your security. Short, regular security awareness training plus simulated phishing emails builds the habit of pausing before clicking. The goal isn't to catch people out; it's to make reporting a suspicious message feel normal and fast.
Everyday users shouldn't have administrator rights on their computers, and former employees shouldn't still have active accounts. Review who has access to what at least twice a year, use separate admin accounts for IT tasks, and turn off accounts the same day someone leaves.
If you can only do three things this month, turn on MFA for email, confirm your backups can actually be restored, and make sure every computer is getting updates. Those three alone put you ahead of most organizations your size.
Want a second set of eyes? CIRRUS provides managed IT and cybersecurity services for small businesses, nonprofits and public agencies across Maryland, DC and Virginia, including 24/7 monitored EDR, backup and Microsoft 365 security. Contact us for a no-pressure security review.
CIRRUS runs IT, security and websites for organizations across Maryland, DC and Virginia. Tell us what you are working on and we will point you in the right direction.
