Protecting a company from data breaches takes more than installing security software. Start by identifying the data and systems that matter, then limit who can access them, secure accounts and devices, protect backups, monitor for suspicious activity, and rehearse how the company will respond. The NIST Cybersecurity Framework (CSF) 2.0 is a useful way to organize that work across governance, prevention, detection, response, and recovery; no checklist can guarantee that a breach will not happen.
Where should a company start?
First, establish what the company needs to protect and which business operations depend on it. Without that picture, it is difficult to decide which security work matters most or whether a recovery plan will restore the services the business actually needs.
As an Amazon Associate I earn from qualifying purchases.
Make a practical inventory
- List sensitive and valuable data, including personal information, and identify a business owner for each category.
- Record where that information is stored, which systems process it, and which employees, contractors, or vendors can reach it.
- Identify critical business functions and the systems, configurations, and providers they rely on.
Keep the inventory proportionate to the organization: a clear record of important data, systems, owners, and dependencies is more useful than an elaborate register no one maintains.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use the NIST CSF 2.0 to check for gaps
NIST’s Cybersecurity Framework 2.0 groups cybersecurity risk management into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Use them as a coverage check, not as a promise of compliance or breach prevention. A company that focuses only on protection may overlook whether it can spot an intrusion, make decisions during an incident, or restore operations afterward.
#1 Best Overall
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
How can the company reduce account and device risk?
Compromised accounts can give an intruder access to email, files, remote connections, and administrative controls. Start with the accounts that can expose the most data or disrupt the most systems.
Require multifactor authentication
- Enable MFA for administrator accounts, remote access, email, file storage, and accounts used to handle sensitive data.
- Where the identity provider and devices support it, prefer phishing-resistant MFA. A FIDO2 hardware security key is one option; verify compatibility and establish a workable process for lost keys and account recovery before rollout.
- Give every user an individual account and limit administrator privileges to people who need them for their duties.
CISA advises businesses to aim for phishing-resistant MFA. MFA reduces the risk that a stolen password alone will be enough to access an account; it does not make compromise impossible.
Keep business devices and software maintained
- Require strong, unique passwords and use a business password manager if that helps employees manage them safely.
- Install security updates for operating systems, applications, and network equipment in a timely way, with a process for tracking devices that are not updated.
- Train employees to recognize and report phishing, and make reporting easy. CISA’s Small and Medium-Sized Business Resources can provide a starting point for smaller organizations.
- Set expectations for device security, especially for laptops that may be used away from the office.
How should sensitive company data be protected?
Reduce the amount of sensitive information an attacker could reach. Use the inventory to find unnecessary copies and locations where data has more exposure than the business requires.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
- Remove data the company no longer needs, subject to applicable retention obligations.
- Avoid storing sensitive information on internet-facing systems or laptops unless the business needs it there.
- Encrypt sensitive information at rest and in transit. If sensitive data must be stored on a laptop, encrypt it and train the user in device security.
- Use firewalls and consider network segmentation to separate systems that store sensitive information from other parts of the environment.
These controls reduce exposure, but they do not replace access limits or monitoring. Review who can reach sensitive data and whether that access is still needed as roles and systems change.
How can backups support recovery from ransomware?
Back up critical information and system configurations automatically and continuously, as CISA recommends. A backup that an attacker can reach through the same network may also be vulnerable to encryption or deletion.
- Keep backup copies isolated from network connections an attacker could use to alter or destroy them.
- Decide how long backups are retained, who is responsible for them, and how the company will retrieve them during an incident.
- Test restoration, including whether restored data is intact and whether critical services can be brought back in a useful order.
Do not treat a successful backup job as proof that recovery will work. A restoration test is what shows whether the company can use its backups to resume operations.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
How can the company detect a breach sooner?
Set a logging and monitoring policy for important accounts, files, and systems. Logs help people investigate what happened, but only if they are available, protected, and reviewed by someone with a clear escalation path.
Recommended Free Tools
- Choose which account, file, and system events to record based on the data and business functions at risk.
- Restrict access to logs and protect them from unauthorized changes or deletion.
- Set retention periods that account for operational needs and applicable compliance obligations.
- Assign responsibility for reviewing alerts and escalating suspected incidents; specify who covers that work when the primary contact is unavailable.
CISA offers no-cost logging resources, including Logging Made Easy. Assess whether a tool fits the systems to be monitored and whether the organization has the capacity to operate it; a tool alone does not provide ongoing review or response.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should the company do before an incident?
Write an incident response and communications plan that gives people a clear way to act under pressure. CISA’s guidance for corporate leaders emphasizes exercises and continuity planning, not just technical defenses.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Assign decision-makers and responsibilities
- Name contacts for security or IT, senior leadership, communications, legal advice, and business continuity.
- Decide who has authority to isolate a system, approve a major operational change, and communicate with employees, customers, or other affected parties.
- Include procedures for preserving evidence and coordinating investigation and recovery.
Exercise response and continuity plans
Run a tabletop exercise in which participants work through a realistic incident and their decisions, contacts, and handoffs. Test continuity plans for critical business functions so the company knows how it will keep operating—or restore operations—if key systems are unavailable.
How should the company assess vendors and cloud providers?
A provider that can access company systems or data is part of the company’s exposure. Include cloud services, collaboration platforms, payment processors, and managed service providers (MSPs) in the risk review.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Ask what company systems and data the provider can access, and how that access is limited and monitored.
- Clarify how the provider will notify and coordinate with the company about a suspected incident.
- Understand how data and full service functionality are recovered after an incident, and what the company must do itself.
- Use a repeatable vendor assessment process, especially for providers with broad access or a role in critical business functions.
CISA’s small- and medium-sized business vendor and supplier assessment guidance addresses cloud and MSP use cases. A provider’s assurances do not replace the company’s own decisions about access, monitoring, and recovery responsibilities.
Which legal requirements apply after a breach?
Notification duties depend on where the company operates, the type of information involved, the circumstances of the incident, and applicable contracts and sector rules. CISA’s guidance says response and communications plans should include breach notification procedures that adhere to applicable state laws, but that does not establish one universal deadline or rule. Have qualified counsel map the requirements for the company’s locations, data, and agreements before an incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
