Set up protections in this order: lock down administrator, email, remote-access and sensitive-data accounts with multifactor authentication; require unique passwords; patch or replace unsupported technology; train staff to report phishing; create isolated, tested backups; secure Wi-Fi and devices; limit access and preserve logs; document incident response; and review suppliers that can reach your systems.
This is a practical baseline for a small business, not a guarantee against attacks or a universal legal checklist. Scale each control to the information you hold, the systems you operate, your staff and budget, and the regulatory or contractual duties that apply to your business.
As an Amazon Associate I earn from qualifying purchases.
Start with a risk-based order of operations
Owners rarely have the time or staff to implement every security control at once. Begin with the accounts and systems that could open the rest of the business, then add recovery and detection capabilities. Assign one person to own each action, even when an outside IT provider performs the work.
Recommended Free Tools
| Priority | Protection | What “done” looks like |
|---|---|---|
| 1 | Multifactor authentication (MFA) | Privileged, remote-access, email, file-storage and sensitive-data accounts require MFA, with recovery methods documented. |
| 2 | Unique credentials | No work password is reused; a password manager stores and shares credentials safely. |
| 3 | Updates and supported technology | Automatic updates are enabled where practical, and unsupported software or hardware has a replacement date. |
| 4 | Phishing process | Staff receive recurring training and know exactly how to report a suspicious message or payment request. |
| 5 | Resilient backups | Critical data and configurations are backed up automatically, with at least one copy isolated from ordinary network access and restoration tests recorded. |
| 6 | Network and device security | Router defaults are changed, current Wi-Fi encryption is used, devices are encrypted, and guest access is separated. |
| 7 | Least privilege and visibility | Access matches job duties; logs are protected and retained for a defined period. |
| 8 | Response and recovery plan | Named people know who decides, who investigates, how operations continue, and how communications are approved. |
| 9 | Third-party review | Providers with access to systems or data have documented security responsibilities, recovery commitments and incident contacts. |
1. Secure the accounts that open the door
MFA requires more than a password, such as a hardware key, an authenticator approval or a one-time code. Turn it on first for administrator accounts, business email, remote access, file storage, financial systems and any service containing sensitive information. Then extend it to every employee account the service supports.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the strongest method your services support
| Method | Phishing resistance | Rollout and recovery considerations |
|---|---|---|
| FIDO2-compatible physical security key | Strongest of the listed options when the service supports it | Buy and register spare keys, protect them from loss, and verify compatibility with each service and device. |
| Authenticator app with number matching | Strong, but users must still approve only expected sign-ins | Require enrollment on a managed device and document how a replacement phone is authorized. |
| Authenticator app with time-based one-time codes | Better than a password alone, but codes can be phished | Provide a secure enrollment and backup-code process; prohibit storing codes in shared notes. |
| Text-message or email codes | Weaker; use only when stronger methods are unavailable | Confirm phone and mailbox recovery details, and set a plan to migrate to a stronger method. |
CISA says, “Businesses should aim to use a phishing-resistant MFA method.” A physical key is an implementation option, not a universal answer: the account service, operating system, browser and device must support it. Do not make MFA optional for administrators while waiting for a company-wide rollout.
Prevent lockouts before enforcing MFA
- Register at least two approved authentication methods for each critical administrator, stored separately.
- Keep one emergency account tightly controlled, monitored and excluded from routine use only where the service’s security design requires it.
- Write down who can reset MFA, how identity is verified, and how a lost phone or key is revoked.
- Test sign-in from a normal workstation and from the documented recovery path before removing the old method.
2. Make passwords unique and manageable
Never reuse a business password across email, payroll, banking, cloud storage or an administrator console. A stolen password should not unlock several systems. The Federal Trade Commission (FTC) recommends strong passwords and describes a minimum length of 12 characters. Longer passphrases that are difficult to guess are preferable to short, complicated patterns.
Use a password manager correctly
A business password manager can generate a different credential for every service, fill it without exposing passwords in documents, and share access through controlled vaults. It does not replace MFA: protect the manager itself with a strong master passphrase and MFA, and limit vault access by role.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Prohibit storing credentials in spreadsheets, browsers shared by several people, chat messages or paper beside a computer.
- Give each worker an individual account where the service permits it; shared accounts make departures and investigations difficult.
- Change credentials immediately when an employee leaves, a provider relationship ends or a password may have been exposed.
- Keep recovery codes and break-glass credentials in a separate, access-controlled location.
3. Patch systems and retire unsupported technology
Enable automatic updates for operating systems, applications, browsers and security software whenever business operations allow it. Schedule a regular review for devices or software that cannot update automatically. Updates close known weaknesses; they do not help a product that no longer receives security fixes.
Maintain a simple technology inventory
Record each laptop, phone, server, router, application and cloud service, its owner, version, update method and replacement date. Include equipment used from home and technology managed by a contractor. Mark unsupported operating systems, applications and hardware as risks with an owner and deadline, then replace or isolate them rather than leaving them exposed.
Handle updates without disrupting work
- Identify critical applications and confirm that an update will not break a required workflow.
- Apply updates to a test device or a small group first when the system is business-critical.
- Schedule remaining updates, verify that protection software is running, and record failures.
- Escalate any device that cannot be updated; do not treat an exception as permanent.
4. Make phishing reporting routine
Phishing often arrives as a plausible invoice, delivery notice, password-reset prompt or urgent request from an executive. Train staff regularly to inspect the sender, unexpected links, attachments, payment changes and requests for credentials. Training should include contractors and temporary staff who handle business mail.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Give employees a safe decision path
- Do not click, open an attachment, reply or enter credentials when a message is unexpected.
- Use the organization’s designated report button, mailbox or phone process.
- Confirm unusual payment, payroll or information requests through a known telephone number or previously verified address, never the contact details in the message.
- If someone clicked or submitted information, report it immediately. Speed allows an administrator to revoke sessions, reset credentials and warn others.
Keep a short record of reported messages and the outcome. Use recurring exercises to reinforce behavior, but do not punish good-faith reports.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Build backups that survive the same incident
Back up important files and critical configurations automatically and continuously where practical. A synchronized folder or cloud drive is useful for availability, but if an attacker can change or delete it with the same account, it is not a complete resilient backup.
Compare backup copies by resilience
| Copy | Purpose | Protection to verify |
|---|---|---|
| Primary working data | Normal operations | Access controls, encryption and monitoring; assume it may be unavailable during an incident. |
| Automated secondary copy | Fast recovery from accidental deletion or device failure | Separate credentials, retention that allows rollback, and protection against mass deletion. |
| Isolated or air-gapped copy | Recovery from ransomware or an administrator compromise | No ordinary network path; restricted write access and encryption. |
| Configuration backup | Rebuilding routers, applications and identity systems | Current versions, protected storage and a documented restoration sequence. |
Test restoration, not just backup completion
- List the files and systems required to deliver essential services.
- Restore a representative sample to a separate test location on a schedule.
- Check that files open, permissions are correct and configurations are usable.
- Measure how long restoration takes and record who performs each step.
- Fix failed jobs, expired credentials or missing data before relying on the backup.
The FTC identifies cloud and external-drive backups as possible approaches. An external drive should be encrypted, disconnected or otherwise isolated when not actively backing up, and stored so theft or fire cannot destroy every copy.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Secure Wi-Fi, devices and physical records
Harden the business network
- Change the router’s default administrator name and password.
- Turn off router remote management unless it is needed and tightly controlled.
- Use WPA2 or WPA3 encryption with a strong network passphrase; replace equipment that cannot use current protection.
- Limit which devices can join the business network and remove unknown devices.
- Create a separate guest network for visitors and, where appropriate, personal devices. Do not let guest traffic reach business systems.
Protect endpoints and removable media
Encrypt laptops, phones and removable drives that contain sensitive information. Set automatic screen locking, use supported security software, and remove local administrator rights from everyday user accounts where feasible. Keep devices and paper files containing sensitive information away from unauthorized physical access. Report lost equipment immediately so accounts, sessions and encryption keys can be revoked.
7. Limit access and preserve useful visibility
Apply least privilege: each person receives only the data, applications and administrative functions required for the job. Review access when someone changes roles and remove it promptly at departure. Separate administrator accounts from ordinary accounts so a routine email compromise does not automatically grant system control.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsLog what helps you investigate
Enable sign-in, administrator, file-access, security-alert and backup logs appropriate to the business. Protect logs from unauthorized alteration or deletion, restrict who can view them, and set retention based on internal policy, contracts and applicable compliance obligations. A small business does not need to collect everything; it needs enough visibility to answer who accessed an account, what changed and when.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Assign a person to review important alerts and define an escalation route for suspicious activity. If no one can monitor a system, reduce its exposure or obtain qualified support.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Write and test an incident-response plan
Use the plain-language question, “How will your business respond to a security incident?” Write the answer before an emergency. The plan should cover credential theft, ransomware, lost devices, fraudulent payments, data exposure and a service-provider compromise.
Define decisions and contacts
- Name the incident leader and a backup decision-maker.
- List internal contacts, IT staff, outside responders, insurers, legal counsel and critical providers, with after-hours details.
- Specify who can disable accounts, isolate devices, preserve evidence, approve payments and speak to customers or regulators.
- Keep a current inventory of systems and the order in which essential services should be restored.
Use a repeatable response sequence
- Identify: confirm the alert, record times and preserve relevant logs.
- Contain: isolate affected devices or accounts without destroying evidence.
- Eradicate: remove malicious access, patch the weakness and reset exposed credentials.
- Recover: restore clean systems from tested backups, monitor closely and verify normal operations.
- Communicate: notify affected parties when appropriate under legal, regulatory or contractual requirements.
- Learn: document what failed and assign corrective actions with deadlines.
Practice the plan with the people and providers who would act. NIST CSF 2.0 organizes this work into Govern, Identify, Protect, Detect, Respond and Recover. The FTC describes the framework as free, voluntary and flexible; it is a planning aid, not a universal compliance certification.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match9. Review third-party and managed-service risk
List every technology or service provider that can access business systems, process sensitive information, host data or affect operations. Ask what the provider secures, what remains your responsibility, how updates are handled, how backups are isolated, how quickly incidents are handled and who can be reached after hours.
Put expectations in writing
- Define the provider’s accounts, permissions and MFA requirements; avoid unrestricted shared administrator credentials.
- Require prompt notice of suspected incidents and identify the people authorized to contact each other.
- Specify backup frequency, retention, encryption, isolation and restoration testing.
- Document service recovery targets and how your business can obtain its data if the relationship ends.
- Review subcontractors and remote-access tools, not just the primary supplier.
A managed IT or cybersecurity provider can supply expertise when the business has none, but ownership of risk remains with the business. Confirm scope, privileged-access controls and recovery commitments directly rather than assuming a provider’s general security statement covers your environment.
Quick Recap
A practical 30-day implementation plan
Days 1–7: close the biggest access gaps
- Inventory administrator, email, remote-access and sensitive-data accounts.
- Enable MFA, beginning with privileged access, and register recovery methods.
- Remove former employees and unnecessary administrator rights.
- Change reused or exposed passwords and place remaining credentials in a password manager.
Days 8–14: reduce known weaknesses
- Turn on automatic updates and identify unsupported devices or software.
- Change router defaults, disable unnecessary remote management and configure a guest network.
- Enable device encryption and screen locking.
- Publish the phishing-reporting route and run a short staff briefing.
Days 15–21: make recovery real
- Identify critical data and configurations.
- Configure automatic backups, including an isolated copy.
- Restore sample files and record the time, result and corrective actions.
- Assign incident-response roles and verify contact details.
Days 22–30: verify and improve
- Review provider access, contracts, backup commitments and incident contacts.
- Check logging and retention for key systems.
- Run a tabletop scenario such as a compromised mailbox or ransomware event.
- Set a recurring calendar review for MFA coverage, updates, access, backups, training and the response plan.
Common failure modes and fixes
| Failure | Why it matters | Corrective action |
|---|---|---|
| MFA enabled only for the owner | An attacker can enter through an employee or contractor account. | Extend MFA to all supported accounts, starting with privileged, remote and sensitive-data access. |
| One synchronized backup folder | Deletion or encryption can propagate to the copy. | Add protected retention and an isolated copy; test restoration. |
| Updates deferred indefinitely | Known vulnerabilities remain exposed. | Automate updates, track exceptions and replace unsupported technology. |
| Staff afraid to report mistakes | Delayed disclosure gives attackers more time. | Make immediate reporting a standard, non-punitive process. |
| Provider has permanent administrator access | A compromised provider account can affect the entire business. | Use named accounts, MFA, least privilege, approval and logging; remove access when work ends. |
| Plan lists no decision-maker | People hesitate during a fast-moving incident. | Name primary and backup leaders, authority limits and after-hours contacts. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
