Remote and hybrid work security depends on more than requiring a VPN or telling staff to choose strong passwords. Small businesses should enforce multifactor authentication (MFA) on critical accounts, keep remote-access devices updated, set clear rules for collaboration tools, and test that backups can be restored. These are practical gaps to check—not a measured ranking of security mistakes by New Mexico businesses.
Where remote-work security plans commonly fall short
Protecting only some accounts with MFA
Password-only access is inadequate for important business accounts. CISA puts it plainly: “Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone.” Enable and enforce MFA for business email, file storage, remote access, financial systems, and other sensitive services. Start with administrator accounts and workers who handle sensitive data, then check that enrollment is required rather than assuming an available setting is turned on. CISA’s small-business MFA guidance explains the options.
As an Amazon Associate I earn from qualifying purchases.
Treating every MFA method as equally resistant to phishing
MFA methods differ. CISA’s guidance ranks physical security keys highest, followed by number-matching authenticator prompts and one-time codes; text-message and email codes are the weakest methods in its listed hierarchy. Prefer a phishing-resistant method when the service supports it. A physical security key for MFA can provide that protection on compatible accounts, but it is not a universal substitute: confirm that the account, device, and sign-in workflow support the key. If they do not, use the strongest available MFA method and set a secure account-recovery process.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAssuming a VPN makes every device safe
A VPN is one control, not a complete security program. VPN software, routers and other network equipment, and the computers or phones employees use to connect all need maintenance. CISA recommends updating VPNs, network devices, and remote-access devices, and enabling MFA on VPN connections. Remove remote-access services the business does not need; CISA specifically advises disabling unused ports and protocols, such as RDP, when unnecessary. See CISA’s ransomware guidance.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Letting convenience decide which collaboration tools staff use
When employees work from home or on the move, they need a clear, approved way to message, share files, and hold meetings. Maintain a list of approved collaboration and teleconferencing tools, along with short instructions for using them securely. CISA’s telework guidance and resources treats employee direction and organizational choices as part of telework security—not just a matter of installing technology.
Backing up data without checking recovery
Back up important files and systems frequently, and separate backup copies from ordinary access where practical. Consider offline and offsite copies. Then test restoration: a backup that has never been restored does not show that the business can recover. CISA’s ransomware guidance and telework resources both support including backups in the plan.
Rank #2
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
A practical order for closing the gaps
- Inventory access. List business accounts, devices, administrators, and every way staff connect remotely. Include employee-used devices and services, not only equipment owned by the business.
- Enforce MFA. Cover email, file storage, remote access, financial tools, and sensitive systems. Prefer phishing-resistant security keys where compatible; document a secure fallback and account-recovery process. Check that users are enrolled and that the service actually requires MFA.
- Patch and reduce remote exposure. Update VPNs, routers and other network devices, and endpoints used for remote access. Disable unneeded remote-access services, ports, and protocols.
- Give staff a safe default. Identify approved collaboration and teleconferencing products, explain how to use them securely, and provide a simple process for reporting suspicious messages or incidents.
- Prove backups can work. Back up important data, keep copies suitably separated from routine access, and test restoring files or systems.
- Assign ownership. Decide who maintains MFA enrollment, updates, backups, and incident response. If the work is outsourced, define the provider’s responsibilities and access before granting them control.
Choosing MFA that fits the business
Security is only one part of an MFA rollout. Check the method against the services and devices employees actually use, and make sure administrators can enforce enrollment and recover accounts safely.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Method | Phishing resistance in CISA’s guidance | What to check before rollout |
|---|---|---|
| Physical security key | CISA’s strongest listed method | Confirm support for each business service and device; establish a spare-key and account-recovery process. |
| Number-matching authenticator prompt | Below security keys in CISA’s hierarchy | Check that the service offers number matching and that staff can use the authenticator on their devices. |
| One-time code | Below number matching in CISA’s hierarchy | Check which code methods the service supports and how the business will protect account recovery. |
| Text or email code | Weakest methods in CISA’s listed hierarchy | Use only when stronger supported choices are unavailable; verify enrollment and recovery arrangements. |
This is CISA’s guidance hierarchy, not a guarantee that a method works identically across every product. Verify compatibility and enforcement in each account’s security settings. CISA’s MFA guidance describes the hierarchy and methods.
Rank #3
- XGS 118 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
When outside IT help makes sense
A small business that lacks internal capacity can consider a managed IT or cybersecurity provider, but should buy defined work rather than a vague promise of “security.” Compare proposals on:
- Scope and responsibility for MFA rollout and enforcement.
- Updates for VPNs, network equipment, and employee devices.
- Backup ownership, restore testing, and incident response arrangements.
- How provider access is limited, monitored, and removed when no longer needed.
- Total cost and what is excluded from the service.
CISA’s resources for small and medium businesses and its telework guidance provide useful baseline tasks for evaluating that scope. CISA’s small-business cybersecurity guidance is a starting point; the business should confirm that any proposed service covers the controls it needs.
Rank #4
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 3 years of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
New Mexico resources—and what they do not establish
The New Mexico Small Business Development Center cybersecurity page points businesses to cybersecurity and data-protection resources. NMSBDC also advertises no-cost individualized business counseling on its main site, which can be a starting point for owners deciding what help they need.
The New Mexico Secretary of State’s business portal guidance concerns its own portal. It says business information there is public within the United States and reports that existing portal users will be prompted to set up MFA beginning July 2026. That portal-specific rollout is not evidence that private employers are legally required to adopt the same approach.
The available evidence does not establish that New Mexico businesses make these mistakes more often than businesses elsewhere, or identify the state’s most common remote-work security failures. The checklist above is a practical baseline for small businesses, not a state-specific ranking.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
