Why should small businesses rethink their cybersecurity strategy?

Small businesses should rethink cybersecurity because their data and work now live in cloud accounts, laptops and supplier systems, not behind one office firewall. A modern plan starts with accounts, sign in, backups, updates and vendor access, using free guidance from CISA and NIST.

What is wrong with the old plan?

The old plan was an antivirus, a firewall and a hope. It assumed the office was the boundary. Today staff use email, file sharing and accounting tools in the cloud, from phones and home laptops. An attacker does not need to break the firewall if they can phish a password.

CISA's Cyber Essentials describes six elements of a culture of cyber readiness: yourself, your staff, your systems, your surroundings, your data and your crisis response. Notice that technology is only one.

What does NIST say small businesses need?

NIST Interagency Report 7621, Small Business Information Security: The Fundamentals, presents the basics of a security program in non-technical language. Its control family tags show the scope: access control, awareness and training, configuration management, contingency planning, identification and authentication, media protection and physical protection among others. It is a reference, not a product.

CISA's Cross-Sector Performance Goals are voluntary and designed to help small and medium organizations focus on a limited number of essential, high impact actions.

What are the most useful first moves?

CISA's guidance for leaders is practical: lead investment in basic cybersecurity, treat cyber as business risk, develop a culture of awareness, learn about phishing and business email compromise, and keep inventories of hardware and software assets. For systems, it tells leaders to use automatic updates.

CISA's ransomware guide adds that backups should be offline and encrypted and tested regularly, because many ransomware variants search for accessible backups to delete or encrypt. It also recommends multi-factor authentication on VPN connections.

What about suppliers and managed providers?

Many small firms outsource IT. That is reasonable, but the provider then holds the keys. The CPG 2.0 update added goals on risks from managed service providers. Ask your provider who has administrative access to your systems, whether they use multi-factor authentication and what you get back if the relationship ends.

A constructed example

A twelve person design studio keeps files in a shared cloud drive, uses a hosted accounting system and has an outsourced IT contractor. In one afternoon the owner does five things. She turns on multi-factor authentication for email and the accounting system. She lists every device and every cloud account. She asks the contractor for a list of who has admin access. She sets up a weekly backup that one person tests monthly. She writes a half page telling staff whom to call about a suspicious email.

That afternoon covers more real risk than another year of antivirus renewals.

What should leaders stop doing?

Stop treating security as a one time purchase. Stop assuming small means unattractive. Stop leaving one person with all the passwords. And stop postponing the first backup test, since an untested backup is a hope, not a plan.

How to check or apply this

1. Make a list of every device, cloud account and application that holds business data.
2. Turn on multi-factor authentication for email, finance and administrator accounts.
3. Turn on automatic updates for operating systems and key applications.
4. Set up offline or immutable backups and test a restore.
5. Ask suppliers who can access your systems and how they sign in.
6. Train staff on phishing and give them one way to report it.
7. Write down who to call and what to do in a bad week.
8. Review the CISA Cyber Essentials toolkit and NIST IR 7621 for gaps.

Quick check

Sources

1. CISA, Cyber Essentials
2. NIST IR 7621 Rev. 1, Small Business Information Security: The Fundamentals
3. CISA, Cross-Sector Cybersecurity Performance Goals
4. CISA, #StopRansomware Guide

Last reviewed: 18 October 2026.