The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The most effective small-business cyber-preparation starts with a few controls that block common account takeovers and make ransomware recoverable: require strong multi-factor authentication (MFA), maintain isolated backups, keep software supported and patched, and write an incident plan that names real people. Then test whether your staff, IT provider and backups can carry out that plan. This sequence is designed for a small organization without a large security team; CISA advises smaller organizations to begin with a simple plan and improve it over time.
What “prepared” means for a small business
Preparation is not a promise that an attack cannot happen. It is the ability to prevent many routine compromises, notice suspicious activity quickly, contain damage, continue essential operations and restore trustworthy systems. A single security product, managed service or insurance policy cannot provide all of those outcomes.
As an Amazon Associate I earn from qualifying purchases.
Start with the systems whose loss would stop the business: email, identity and administrator accounts, customer and financial records, line-of-business applications, file storage, websites, payment systems, phones and the configurations needed to rebuild them. Give each system an owner and decide which must return first. That priority list drives your access controls, backup schedule, communications and recovery decisions.
CISA’s May 23, 2023 supply-chain fact sheet, citing the Small Business Administration, described more than 31.7 million small and medium-sized businesses, 41.7 percent of private-sector employees and nearly half of U.S. GDP. The measurement year for those figures was not visible in the cited result, so do not present them as current-year statistics without checking the original SBA publication. The practical point remains: a small company can hold valuable data and provide an important service even when it has only a few employees.
#1 Best Overall
1. Build a short, usable inventory
You do not need a perfect asset database before taking action. Make a working list, then improve it as you learn more. Include:
- Business email, identity-provider and administrator accounts.
- Remote-access tools, virtual private networks, remote desktop services and vendor portals.
- Laptops, desktops, mobile devices, servers, network equipment and equipment used at home.
- Cloud file storage, accounting, payroll, customer-management, ecommerce and payment services.
- Critical data, where it is stored, who can access it and how long the business needs it.
- Outside IT companies, software vendors, cloud administrators and other providers with access.
For every item, record an owner, the authentication method, the backup location, the support contact and the business process that depends on it. Mark the systems that must be restored first. This is an editorially practical starting point; CISA’s guidance emphasizes critical data, continuity and provider coordination rather than prescribing one inventory template.
2. Close the most dangerous access gaps
Turn on MFA in the right order
Enable MFA first for administrator accounts, business email, remote access, file storage and systems containing sensitive data. Then extend it to every service that supports it. Use a separate privileged account for administrative work and a standard account for routine tasks where your technology permits it. Remove former employees, shared accounts and unused administrator access promptly.
Phishing-resistant MFA is preferable. CISA’s relative order is a physical security key, an authenticator app using number matching, an authenticator app using one-time codes, biometrics (best paired with another method), and text or email codes. Text and email codes are weaker because attackers can redirect or intercept them. A FIDO2-compatible hardware key can be a strong option, but check that your identity provider, browsers, phones and computers support the required standard before buying keys. Plan how a person will recover access if a key is lost; issue a protected spare or document an administrator-assisted recovery process.
| MFA method | Phishing protection | Practical guidance |
|---|---|---|
| Physical security key | Strongest option in CISA’s listed hierarchy | Check provider and device compatibility; protect a spare and recovery process. |
| Authenticator app with number matching | Stronger than one-time codes | Use where supported and train staff to reject prompts they did not initiate. |
| Authenticator app with one-time codes | Better than text or email codes | Protect the enrolled device and document replacement steps. |
| Biometrics | Best paired with another method | Use as part of a broader MFA configuration, not as the only safeguard. |
| Text or email codes | Weaker protection | Use only when stronger methods are unavailable, and plan an upgrade. |
Limit privileges and remote access
Grant each person and provider only the access needed for their work. Review administrator and service accounts at least whenever roles change, and on a regular schedule. Disable remote services that are not required. Restrict management interfaces to approved networks or devices where feasible, and require MFA for every remote-access path.
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
Do not assume that an IT provider’s account is harmless. It may reach every workstation, backup system or cloud tenant. Require MFA, use named accounts rather than shared credentials, limit permissions, and know how to revoke access quickly.
3. Keep software supported and maintained
Enable automatic updates where they are reliable, and establish a process for updates that require testing or a maintenance window. Prioritize internet-facing applications, operating systems, browsers, remote-access tools and security software. Replace unsupported operating systems and appliances; a product that no longer receives security fixes is a continuing exposure.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Maintain an accurate list of installed software and versions. Remove applications you no longer need. Back up configurations before major changes so that a failed update does not become an avoidable outage. Patching does not replace MFA, backups or staff reporting; CISA treats maintenance as one part of a set of complementary controls.
4. Design backups for recovery, not just storage
Back up critical business data and the configurations required to rebuild systems automatically and frequently. Keep at least one copy isolated or air-gapped where feasible, so an attacker who compromises production credentials cannot encrypt or delete every copy. CISA’s ransomware guidance also discusses offline and cloud-to-cloud backup approaches.
Define what a usable backup requires
- A documented list of data and configurations covered.
- Automatic schedules appropriate to how quickly the information changes.
- Separate credentials and MFA for backup administration.
- Retention that lets you recover from an infection discovered days or weeks later.
- Protection against ordinary users deleting or altering backup history.
- A written restoration procedure and a person responsible for executing it.
A backup is not proven until you retrieve files and rebuild a representative system. Run restoration tests on a schedule, record how long each step takes and fix failures while systems are still available. Your test should include the isolated copy, not only the copy connected to production. There is no universal recovery-time target in the available guidance; set targets according to the business process, contractual commitments and the consequences of downtime.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
5. Add visibility and make reporting easy
Enable logging on important servers, endpoints, network devices and cloud services where those systems provide it. Logs can reveal unusual sign-ins, privilege changes, mass file changes, new forwarding rules and attempts to disable security controls. Assign someone to review alerts and define what requires immediate escalation. Protect logs from unauthorized access or deletion, ideally by sending copies to a separate system or account.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor organizations that need a starting point, CISA’s small-business logging guidance points to its no-cost Logging Made Easy tool. Treat it as a way to improve visibility, not as a substitute for deciding which events matter or who will respond.
Give employees a short reporting route: a monitored address, phone number or help-desk option that does not depend on the suspected account. Tell staff to report suspicious messages, unexpected MFA prompts, lost devices, unusual file behavior and suspected disclosure immediately. Early reporting is more useful than blame; employees should not delay because they clicked a link or entered a password.
6. Write an incident plan people can execute
A plan should answer who does what in the first hour, not merely describe security principles. CISA says smaller organizations can begin with a simple plan and recommends practicing it at least annually.
Name the decision-makers
- Incident coordinator: declares an incident, sets priorities and keeps the action log.
- Technology lead: isolates devices, protects evidence, contacts the IT provider and directs restoration.
- Communications lead: prepares employee, customer, supplier and public messages through approved channels.
- Legal or privacy adviser: evaluates reporting, contractual and regulatory obligations.
- Business-continuity owner: decides how to operate manually or from alternate systems.
- Executive decision-maker: approves shutdowns, emergency spending and risk decisions.
Put names, alternates and out-of-band contact methods in the plan. Include your IT provider, key software vendors, building or facilities contacts and, where appropriate, law-enforcement contacts. Keep a printed or otherwise offline copy because email and shared drives may be unavailable during an incident.
Recommended Free Tools
Specify first actions
- Confirm the report and open an incident record with the time, systems involved and person who noticed it.
- Use a trusted communication channel to assemble the response team.
- Contain the suspected access: isolate affected devices, disable compromised accounts or revoke sessions as directed by the technology lead. Avoid destroying evidence.
- Protect backups and administrative accounts before attempting broad restoration.
- Engage the IT provider and legal or privacy adviser according to the plan.
- Decide which business processes must continue manually and what information customers or partners need.
- Restore from known-good backups, change credentials and monitor for recurrence.
- Record decisions, evidence locations, notifications and follow-up actions.
Practice once a year
Conduct a simple walk-through using a realistic scenario, such as a compromised email account or unavailable business files. Ask who declares the incident, how staff report it, which accounts are disabled, where the offline plan is stored, how customers are contacted and how restoration is verified. Correct missing contacts, permissions and recovery steps immediately after the exercise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Make outside providers part of the security boundary
An MSP, cloud administrator, backup company or software vendor can speed recovery, but it can also provide a path into many systems. Before signing or renewing an arrangement, ask:
- Which systems, accounts and data can the provider access?
- Are provider accounts named, protected by MFA and limited to necessary privileges?
- How are administrative sessions logged, and how long are logs retained?
- Are backups automatic and continuous for critical information and configurations where appropriate?
- Is at least one backup location isolated or air-gapped?
- Who detects, declares and leads an incident?
- Who can isolate systems, restore data, communicate with customers and preserve evidence?
- How quickly will the provider notify you, and how can you revoke its access?
Put responsibilities, contact methods, backup ownership, restoration assistance, evidence handling and notification expectations in writing. Review the arrangement when systems or personnel change. CISA’s MSP guidance stresses limiting provider permissions, using MFA and maintaining isolated backups; it does not rank commercial providers.
What to do after a cyber attack
If an attack is underway, use the incident plan rather than improvising. Do not keep using a suspected compromised account to coordinate the response, and do not wipe devices before the technology or legal lead decides what evidence is needed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Compromised email or identity account
- Use a trusted device and channel to contact the response team.
- Revoke active sessions and tokens, reset the password and check MFA methods.
- Review mailbox forwarding rules, delegated access, sent mail and recent sign-ins.
- Check whether the attacker accessed file storage, payroll, payment or customer systems through the account.
- Warn contacts about fraudulent messages sent from the account.
Ransomware or unavailable files
- Disconnect affected devices or network segments as directed, while preserving evidence.
- Protect backup administration accounts and verify that backups were not altered.
- Identify the first affected systems and the likely time window.
- Use the incident team and IT provider to determine whether restoration from a known-good, isolated copy is possible.
- Restore in business priority order, patch systems, reset credentials and monitor before reconnecting broadly.
Suspected data exposure
Preserve logs, affected devices and relevant communications. Ask qualified legal or privacy counsel to assess applicable reporting duties, contractual requirements and regulator or law-enforcement contacts. Requirements vary by sector and jurisdiction; a general checklist cannot determine them. Communicate confirmed facts without speculation, and document what was reviewed and when.
A proportionate 30-day starting sequence
- Days 1–3: list critical accounts, devices, services, data and providers; identify the systems needed first for operations.
- Days 4–7: enable MFA on administrator, email, remote-access and file-storage accounts; remove stale users and shared administrator credentials.
- Week 2: verify automatic updates, replace unsupported software and restrict unnecessary remote access.
- Week 3: configure frequent backups, create an isolated or air-gapped copy where feasible and perform a test restoration.
- Week 4: enable relevant logging, assign alert review, publish the staff reporting route, write the incident plan and schedule an annual exercise.
After this first cycle, repeat the review when you add a cloud service, change an IT provider, move sensitive data, acquire a business or change key personnel. Security improves through maintained habits, not a one-time setup.
Common preparation mistakes
- Buying MFA hardware without checking compatibility: verify identity-provider, browser and device support and document recovery before rollout.
- Keeping every backup online with the same administrator password: separate credentials and isolate at least one copy where feasible.
- Training without technical controls: awareness helps reporting, but it does not replace MFA, patching, least privilege or backups.
- Assuming the IT provider owns every decision: the business must retain clear authority over access, communications, legal advice and continuity.
- Writing a plan no one rehearses: annual walk-throughs expose missing contacts and permissions before an emergency.
- Waiting for certainty before reporting: unusual MFA prompts, lost devices and suspicious messages are reasons to report early.
- Treating insurance as prevention: coverage may be an optional risk-transfer decision, but it does not secure accounts or restore systems by itself.
The Bottom Line
Prepare in this order: inventory critical systems, secure privileged and remote access with strong MFA, maintain supported software, build and test isolated backups, enable useful logging, train rapid reporting, and rehearse a named incident plan with every outside provider involved. That combination gives a small business practical resistance and a recoverable path when prevention fails.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
