Why would an attacker target a small business?
Attackers do not need a famous target. They look for exposed accounts, unpatched systems, weak remote access, reusable passwords and employees they can trick at scale. A smaller company may also provide access to customer data, payments or larger business partners.
Where should a small business start?
Start with the business, not a product list. Identify the systems, accounts, data and providers required to operate. Then prioritize the failures that would stop work, expose sensitive information or create an expensive recovery.
- Name one person responsible for coordinating cybersecurity
- Inventory critical systems, cloud services and outside providers
- Require multi-factor authentication for important accounts
- Keep software and devices supported and updated
- Maintain protected backups and test restoration
- Write down incident contacts and first actions
What do Govern, Identify, Protect, Detect, Respond and Recover mean?
These are the six functions in the NIST Cybersecurity Framework 2.0. In plain language: decide who owns risk, know what matters, reduce likely attacks, notice suspicious activity, contain incidents and restore the business.
Is antivirus enough for a small company?
No single product covers identity, email, devices, cloud applications, network access, backups, monitoring and response. Endpoint protection can be useful, but it belongs inside a broader plan with clear ownership and tested recovery.
What should an incident-response plan contain?
The plan should name decision-makers, technical and legal contacts, cyber-insurance requirements, critical vendors, communication methods, evidence-preservation steps and the first actions for common events such as account takeover, ransomware or lost equipment.
How often should the plan be reviewed?
Review it after major technology, staffing or provider changes and after any incident or exercise. At minimum, confirm the contact list, backups, privileged accounts and response steps on a regular schedule.