Cybersecurity for small business: the 10 controls that matter
Published
Cybersecurity for a small business comes down to about ten controls: multi-factor authentication, a password manager, automatic updates, tested backups, endpoint protection, email authentication, a payment call-back rule, separate admin accounts, short staff training and a one-page incident plan. Together they cost most companies less than $40 per employee per month, and some are free.
The list follows the U.S. government's own starting points for small organizations, CISA's Cyber Essentials and NIST's CSF 2.0 Small Business Quick-Start Guide, in the order we would do them.
The 10 controls, in order
1. Multi-factor authentication everywhere
Start with email, banking, payroll and every administrator account, then everything else. Use an authenticator app or a security key; text-message codes are better than nothing but easier to intercept. Cost: included in Microsoft 365, Google Workspace and most banks.
2. A password manager for the whole team
Unique passwords for every service, shared vaults instead of passwords in spreadsheets, and one place to revoke access when someone leaves. Cost: business plans run roughly $4 to $8 per user per month (for example, Bitwarden Teams or 1Password Business).
3. Automatic updates, and nothing unsupported
Turn on automatic updates for operating systems, browsers and the apps everyone uses. Replace devices and software that no longer get security updates. Cost: free, except for the hardware you replace.
4. Backups you have actually restored
Keep at least one copy that ransomware can't reach (offline or immutable cloud storage), back up your Microsoft 365 or Google Workspace data too, and restore one file every quarter to prove it works. Cost: a few dollars per user or per device per month.
5. Endpoint protection on every computer
Modern endpoint detection and response (EDR) catches what classic antivirus misses and lets you isolate an infected laptop remotely. Cost: Microsoft 365 Business Premium, at about $22 per user per month, includes it along with device management; standalone EDR for small businesses starts at a few dollars per device.
6. Email that can't be spoofed
Publish SPF, sign with DKIM and set a DMARC policy of quarantine or reject, so nobody can send email that appears to come from your domain. When we measured businesses with websites in four Venezuelan cities, 72 (350 of 489) had email that could be spoofed; small companies elsewhere are rarely much better. Check yours from any terminal:
nslookup -type=txt _dmarc.yourcompany.comYou want a line starting with v=DMARC1 and p=quarantine or p=reject. Cost: free; it's a DNS record.
7. A call-back rule for money
Any request to change bank details, pay a new supplier or buy gift cards gets confirmed by phone, on a number you already had, never the one in the email. This one rule stops most business email compromise. The FBI recorded $2.77 billion in reported business email compromise losses in 2024. Cost: free.
8. Separate admin accounts
Nobody reads email or browses the web with an administrator account. Give admin rights only to the people who need them, and remove access the day someone leaves. Cost: free.
9. Twenty minutes of training, twice a year
Show your team the phishing emails and fake invoices that actually reach your inbox, and make reporting a suspicious message easy and blame-free. Cost: free with CISA and FTC material; paid phishing simulation platforms charge a few dollars per user per month (compared in KnowBe4 alternatives).
10. A one-page incident plan
Who decides, who you call (your IT provider, your bank, your insurer), how you reach staff if email is down, and where to report: the FBI's IC3 for fraud and ransomware. Print it. Cost: free.
What it costs, all together
| Control | Per user, per month |
|---|---|
| MFA, updates, admin accounts, call-back rule, incident plan | $0 |
| Email authentication (SPF, DKIM, DMARC) | $0 |
| Password manager | $4–8 |
| Endpoint protection and device management | $3–22 |
| Backups (devices and cloud email) | $2–6 |
| Phishing training platform (optional) | $0–4 |
| Total | about $9–40 |
List prices in October 2026; they change, and annual billing is usually cheaper. If you already pay for Microsoft 365 Business Premium, much of the endpoint and device line is covered.
Free help from the U.S. government
- CISA Cyber Essentials: a starter kit and toolkits for small business leaders, organized in six areas from staff to crisis response.
- NIST SP 1300: the Cybersecurity Framework 2.0, cut down for companies with little or no formal security plan.
- FTC Cybersecurity for Small Business: one-page guides on phishing, ransomware and vendor security you can hand to staff.
When to bring in outside help
If you handle health records, card payments or defense contracts, the rules (HIPAA, PCI DSS, CMMC) require more than this list, and an assessment from a specialist pays for itself. If your customers start sending security questionnaires, the next step is usually a SOC 2 report; see what SOC 2 costs and the platforms that automate it.
Sources: CISA Cyber Essentials · NIST SP 1300 · FBI IC3 2024 Internet Crime Report · our own measurement of email authentication in Caracas, Maracaibo, Valencia and Barquisimeto (method, in Spanish).
Questions people ask
What is the most important cybersecurity measure for a small business?
Multi-factor authentication on email, banking and every admin account. Stolen or guessed passwords are behind a large share of break-ins, and MFA stops most of them for little or no cost.
How much should a small business spend on cybersecurity?
The ten controls in this guide cost most companies under $40 per employee per month in software, often much less if you already pay for Microsoft 365 or Google Workspace. Add a few hours a month of someone's time to keep them running.
Do small businesses really get targeted?
Yes, mostly by automated and financially motivated attacks rather than targeted ones. Business email compromise alone cost U.S. victims $2.77 billion in 2024 according to the FBI, and much of it came from small and midsize companies paying fake invoices.
Do I need cyber insurance?
If an outage or a stolen payment would hurt the business, it's worth a quote. Insurers now ask about MFA, backups and endpoint protection before they price a policy, so the controls in this guide also lower the premium.