A small business cyber resilience plan helps you manage cyber risk, keep essential work moving during a disruption, respond to an incident, and restore affected services and data. To build one, assign decision-makers, identify what the business must protect and keep running, apply practical safeguards, plan and test recovery, and rehearse how you will respond. NIST’s voluntary Cybersecurity Framework 2.0 and its small-business quick-start guide offer a structure for doing this without assuming you have a dedicated security team.
1. Set the plan’s scope and assign ownership
Start with the people and operations the plan must support. Name one person accountable for keeping it current and a backup decision-maker who can act if that person is unavailable. They do not need to be cybersecurity specialists, but they should know who to contact for technical and legal advice.
As an Amazon Associate I earn from qualifying purchases.
Make a practical inventory with the people who run the business. Record:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Essential services and processes, such as sales, payroll, customer service, and order fulfillment.
- Devices, business accounts, networks, cloud services, and the data each process depends on.
- Sensitive information the business holds and who needs access to it.
- Vendors or service providers with access to systems or information, including remote access.
- The people and outside support needed to keep essential work going and restore systems.
For each essential process, ask what would stop if a particular account, device, vendor, or system became unavailable. This helps focus limited time and budget on the dependencies that matter most to operations.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Requirements are not identical for every business. Check applicable legal, regulatory, insurance, and customer-contract duties with qualified advisers where needed. The FTC’s small-business guidance says to understand your own requirements; it does not establish one notification deadline for every business or incident.
2. Organize the work with NIST CSF 2.0
NIST’s Cybersecurity Framework 2.0 groups cyber risk management into six connected functions: Govern, Identify, Protect, Detect, Respond, and Recover. It is a flexible, voluntary framework—not a certification or a guarantee that an organization is secure. The framework can help a small business see whether its plan covers more than prevention alone.
NIST Special Publication 1300, NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide, was published in February 2024. NIST describes it as a starting point for small and medium-sized businesses with modest or no existing cybersecurity plans.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Govern: Set responsibility, priorities, and expectations for managing cyber risk.
- Identify: Understand the business’s systems, data, vendors, and operational dependencies.
- Protect: Put safeguards in place to reduce the chance or impact of a disruption.
- Detect: Know how the business will notice signs of a possible incident.
- Respond: Contain and investigate an incident, make decisions, and communicate.
- Recover: Restore systems and data and return essential work to normal.
Use these functions to spot missing responsibilities and tasks. A small business can start with a short list of actions and expand it as its systems, risks, and capacity change.
3. Put routine safeguards in place
Basic protections are most useful when they are part of ordinary operations rather than one-time projects. Choose an owner and a workable schedule for each safeguard.
- Update software: Turn on automatic updates where appropriate or schedule updates for operating systems, applications, and devices. Include equipment used for business even if it is not centrally managed.
- Use strong, unique passwords and MFA: Avoid reusing passwords across accounts. Require multifactor authentication (MFA) on business accounts, especially email, financial services, and administrator accounts. The FTC lists authenticator apps, USB hardware tokens, and PIV cards as possible additional login factors. Check that the method is supported by the account and device, and decide how authorized users can regain access if a factor is lost.
- Limit access: Give staff and vendors access only to the information and systems their work requires. Review access when someone changes roles or leaves, and periodically check whether vendor access is still needed.
- Protect information and networks: Use encryption for sensitive information and secure business Wi-Fi. Keep administrative access limited, and avoid leaving remote access open to people or services that no longer need it.
- Train employees: Give staff practical guidance on recognizing suspicious messages, protecting account credentials, and reporting something unusual promptly. Make clear whom to contact so people do not have to guess during a suspected incident.
These safeguards reduce avoidable risks but do not remove the need to detect, respond, and recover. A security key, software update, training session, or other single measure is not a complete plan.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Make backups and recovery workable
A backup is useful only if the business can access a usable copy when needed. Identify the critical data and systems from your inventory, decide how often copies need to be made for your operations, and assign someone to check that the process is working. The FTC names cloud storage and external hard drives as possible backup destinations and advises keeping backups off the network.
- Choose what to back up: Include the information and systems needed to restart essential work, not just files that are easy to copy.
- Choose a destination and access method: Select an option that fits the business’s data and operational needs. Arrange the process so an attacker using the ordinary business network cannot automatically reach every backup copy.
- Set a schedule and owner: Decide how often copies are made and who checks that they completed. Make the task part of business operations.
- Test a restoration: Restore selected files or systems in a controlled test. Check that the data is usable and that the person responsible knows how to perform the recovery.
- Plan for the gap: Record who can restore information and how staff will continue essential work while systems or data are unavailable.
Buying an external drive does not by itself create a recovery plan. The business also needs a dependable copying routine, protection against an attacker reaching every copy, and a tested way to restore what it needs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Write incident and continuity actions
Keep the response plan accessible to the people who may need it, including when ordinary email or business systems are unavailable. It should give them a clear first move and identify who can make decisions. Include:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Contacts and roles: List the accountable person, backup decision-maker, technical support, relevant vendors, and other advisers. Keep contact details somewhere they can be reached if affected systems are down.
- Containment: Describe who is authorized to isolate an affected device or account and how to escalate a suspected incident. Avoid improvising changes that could disrupt evidence or essential services; bring in qualified technical help when needed.
- Investigation and support: Note how to reach experienced IT staff or an outside cybersecurity firm if the business lacks the expertise to investigate and mitigate an attack. The cited guidance supports seeking this kind of help but does not endorse a particular provider.
- Continuity: Identify how essential work will continue while systems are unavailable, who will coordinate that work, and what information or temporary processes staff need.
- Restoration: Set out who decides when systems are ready to restore, who performs the work, and how recovery will be checked.
- Communication: Plan how to communicate with employees, customers, vendors, and authorities as appropriate to the incident and applicable requirements. Do not assume a universal notification deadline; duties depend on the business, location, data, contracts, and incident facts.
These actions connect incident response with recovery: the business needs to contain and understand what happened while also deciding how to keep essential work going and restore affected services and data.
6. Review and practice the plan
A plan can become outdated when staff, vendors, systems, or business processes change. Review it when a meaningful change occurs and schedule a periodic check so ownership, contacts, and recovery steps do not depend on memory.
Walk through a realistic scenario, such as unavailable business email or encrypted files. Ask the assigned people to find the contact details, explain who can make decisions, describe how essential work would continue, and show how critical data would be restored. Record gaps and revise the plan based on what the exercise reveals.
The FTC Safeguards Rule guidance discusses written incident response plans and post-event review for entities subject to that rule. The rule applies to covered financial institutions; it should not be treated as a blanket requirement for every small business. Check which obligations apply to your business rather than borrowing a rule’s requirements as universal advice.
7. Use official starting points
NIST’s small-business quick-start guide is intended for organizations with modest or no existing cybersecurity plans and organizes work across all six CSF 2.0 functions. The FTC’s Cybersecurity for Small Business guidance covers routine protections, backups, incident planning, and the need to understand business-specific requirements. CISA also maintains a collection of small and medium-sized business security and response resources. These resources can help you shape the plan; your actual duties and the right recovery arrangements depend on your business and its circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
