SMB cybersecurity requires understanding what the business is protecting and how much disruption it can withstand, before purchasing a single product. Accounting files, customer records, e-mail and the sales system may have different priorities. The first goal is not to eliminate all risks in a month, but to make important vulnerabilities visible and manageable.
First week: Identify assets and critical accounts
Make a list of computers, phones, servers, modems and cloud services used. Write down the owner, intended use, and update status of each asset. If it is not known who manages a service, this is also a finding that should be followed up. Do not exclude supplier-managed systems from the list; Record which side is responsible.
Prioritize accounts used for business email, domain, cloud management and payment processes. Reduce shared password sharing; Restrict employees from managing corporate resources with their personal accounts. Determine from the beginning who will deny access to the person leaving the job.
Week two: Strengthen identity and access
- Enable appropriate MFA on administrative and critical accounts.
- Do not grant unnecessary administrative rights to the everyday user.
- Change reused passwords and establish an institution-approved management method.
- Review remote accesses, vendor accounts, and unused users.
- Verify availability of recovery codes and domain ownership information.
Week three: Verify updates and backups
Identify devices awaiting updates and out-of-support software. Plan maintenance windows and turnaround steps on critical systems. Delaying the update indefinitely or applying it unpreparedly to all systems at the same time can also challenge business continuity. Prioritize based on exposure and job impact.
Check the extent of the backed up data and perform a sample restore test. Consider whether backups can be deleted with the same account. Just because a supplier says "we are taking backup" does not alone prove that you can return on the date and time you need.
Week four: People and event plan
Conduct a short phishing awareness session. Make it clear to whom the employee will forward the suspicious message. Instead of a culture that makes it difficult to report errors, make it easy to report early. Choose training examples that do not collect real passwords and do not embarrass people.
Do a desk exercise with a hypothetical scenario where a device is compromised: Who will make the decision, which service will stop, who will reach out to the vendor, and who will restore the clean backup? Phone lists and critical access information should not remain solely on corporate email, which may be inaccessible.
Results you can measure at the end of the month
| control | sample measurement |
|---|---|
| Asset visibility | Number of devices and services with designated owner |
| Account Security | Percentage of MFA-enabled critical accounts |
| backup | Number of restores successfully attempted |
| event preparation | Contact list and desk trial date |
Frequently asked questions
Can I start without buying a security product?
Yes. Inventory, account review, assigning responsibility, and testing existing backup are important initial steps. Product selection becomes more meaningful after these needs are determined.
Does this plan ensure regulatory compliance?
It is not a certificate of compliance or a guarantee of competence on its own. Requirements specific to your industry, data and contracts should also be evaluated.
Next step: risk planning tool, backup plan and MFA guide use together.
Source and further reading
CISA: Require Multifactor Authentication and CISA: #StopRansomware Guide. Source check date: 17 October 2026.
