A practical cyber-readiness baseline for small businesses

Start with business ownership

Cybersecurity works better when leadership treats it as an operating risk rather than a collection of technical products. Begin by naming who owns decisions, which services the business cannot operate without, and how much interruption the organization can tolerate.

A short, reviewed policy is more useful than a large document nobody follows. Record who approves access, who receives incident reports, who can authorize emergency changes, and who communicates with customers or vendors during disruption.

Know the systems and information that matter

An organization cannot protect what it has not identified. Maintain practical inventories of devices, software, cloud services, administrators, vendors, and important information. Include ownership and support status so unsupported systems and forgotten accounts are visible.

• List business-critical applications and the processes that depend on them.
• Identify where customer, employee, financial, and contractual information is stored.
• Remove unsupported or unauthorized hardware and software through a controlled process.

Reduce avoidable access risk

Use unique accounts, multifactor authentication, and least-privilege access. Begin with administrators, remote access, email, financial systems, and cloud management. Review access when people change roles or leave the organization.

Passwords and authentication codes should not travel through ordinary email or website forms. Support processes should define an approved way to verify users and authorize remote access without collecting unnecessary credentials.

Patch, back up, and verify

Enable supported automatic updates where appropriate and create a process for testing and applying high-priority patches. Backups must be protected from the same incident that could affect production systems. A backup is only useful when restoration has been tested and recovery priorities are known.

Prepare to respond before an incident

Document who makes decisions, which systems are restored first, how evidence is preserved, and which outside parties should be contacted. Exercise the plan with a realistic scenario. The goal is not a perfect script; it is faster coordination under pressure.

Use a repeatable review cycle

Security conditions change as staff, vendors, applications, and contracts change. Review the baseline after significant changes and at a regular leadership cadence. Record decisions and unresolved risks so the next review starts with evidence rather than memory.