Lesson 9 of 16 · Level 3: Advanced
Cybersecurity for Small Business: A Starter Plan
- ⏱ 14 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
- 📥 Downloadable template
In this lesson
- Why small businesses are frequent targets and which four incidents hit them most.
- Which U.S. rules may apply to your business, including the FTC Safeguards Rule, HIPAA and state breach laws.
- A 90-day starter plan that covers the essentials without a full-time security team.
- How to score your progress with a weighted checklist and calculate % compliance.
- How a 12-person accounting firm in Charlotte went from 32% to 91% in one quarter.
The small-business checklist has 24 controls grouped by area, a priority weight for each and formulas that calculate your score and % compliance automatically.
- cybersecurity-checklist.xlsx · Small Business Checklist sheet
A small business doesn't need an enterprise security program. It needs a short list of controls that stop the attacks that actually happen to companies its size, a named person responsible for them, and a simple way to track progress. This lesson gives you that list as a 90-day plan, shows which legal rules might already require parts of it, and teaches you to measure progress with a weighted score so you can show an owner, an insurer or a client exactly where you stand.
- Know your real threats
- Check which rules apply
- Follow the 90-day plan
- Score your progress
- Keep it going
Why small businesses get hit
Criminals don't need to pick you specifically. Automated tools scan for unpatched systems and send phishing to thousands of addresses; small businesses simply tend to have fewer defenses, no dedicated security staff and money or data worth stealing. They're also valuable as a stepping stone into bigger clients. These four incidents cause most of the pain:
Business email compromise
Fake or hijacked emails redirect payments. Losses reported to the FBI's IC3 reached about $3 billion in 2025.
Stop it with: MFA on email and a call-back rule for payment changes.Ransomware
Encrypts systems and often steals data first.
Stop it with: patching, MFA on remote access, least privilege and offline backups.Account takeover
Reused or phished passwords open email, banking and cloud accounts.
Stop it with: a password manager and MFA for everyone.Lost or stolen devices
Laptops and phones with client data left in cars and airports.
Stop it with: full-disk encryption, screen locks and remote wipe.Which rules might apply to you
Before choosing controls, check whether the law already requires some of them. This overview is educational, not legal advice; confirm your obligations with an attorney or your industry association.
| If your business… | Rule | Key requirements |
|---|---|---|
| Prepares taxes, brokers mortgages, lends, collects debts or offers other financial services | FTC Safeguards Rule (under GLBA) | A written information security program, a "Qualified Individual" in charge, a written risk assessment, MFA, encryption, training, vendor oversight, an incident response plan and a yearly written report to leadership; notify the FTC within 30 days of a breach of unencrypted data affecting 500+ consumers |
| Is a tax or accounting practice | Same rule, reinforced by the IRS | The IRS reminds tax professionals that federal law requires a Written Information Security Plan (WISP); IRS Publication 5708 provides a template |
| Provides health care and bills electronically | HIPAA | Risk analysis, administrative, physical and technical safeguards, breach notification within 60 days |
| Accepts credit and debit cards | PCI DSS (a card-industry standard enforced through your payment processor) | Protect card data; using hosted payment pages or certified terminals greatly reduces what you must secure |
| Holds personal data of residents of any state | State breach notification laws (all 50 states, DC, Guam, Puerto Rico, USVI) | Notify affected residents (and sometimes the attorney general) after certain breaches; rules vary by state |
The FTC exempts financial institutions that hold customer information on fewer than 5,000 consumers from certain provisions of the Safeguards Rule, but not from the core duty to protect that information. Small doesn't mean exempt.
1. A tax preparation firm covered by the FTC Safeguards Rule discovers that unencrypted information of 800 clients was stolen. What does the rule require regarding the FTC?
Since May 13, 2024, the Safeguards Rule requires notifying the FTC within 30 days of discovering a breach of unencrypted information involving at least 500 consumers. State notification laws and IRS reporting may also apply.
The 90-day starter plan
You don't have to invent a program. Free, well-respected starting points include the FTC's small business cybersecurity materials, CISA's Cross-Sector Cybersecurity Performance Goals (updated to version 2.0 in December 2025 and aligned with NIST CSF 2.0), the CIS Controls Implementation Group 1 and NIST's small business quick-start guide for CSF 2.0. They overlap heavily, and this plan pulls together their most common essentials:
- Week 1Name an owner and take inventoryChoose one person responsible for security (the Safeguards Rule calls it the Qualified Individual). List every device, account, cloud service and type of sensitive data you hold.
- Days 1–30Lock the front doorsMFA on email, banking, payroll and remote access; a business password manager for all staff; automatic updates on every device; full-disk encryption on laptops.
- Days 31–60Reduce the blast radiusOffline or immutable backups with a tested restore; remove admin rights from daily accounts; SPF, DKIM and DMARC for your email domain; the payment call-back rule; first phishing training.
- Days 61–90Prepare for the bad dayWrite the WISP or security policy, a one-page incident response plan with contact numbers, review vendor access and run a 60-minute tabletop exercise.
- Every quarterReview and re-scoreUpdate the checklist, test a restore, review user access and report progress to the owner.
What does it cost?
Costs vary widely by region, provider and number of devices, so get quotes. As a planning illustration, here's how a 12-person firm split a $10,000 first-year budget:
Managed IT and patching $3,500 · endpoint detection and response $2,000 · backup service $1,500 · password manager and security keys $1,000 · training $1,000 · help writing the WISP and incident plan $1,000. Total $10,000.
Insurers commonly ask whether you use MFA, keep offline backups, run endpoint protection and train staff. The 90-day plan often makes coverage easier to get, and an insurer's questionnaire is a good free checklist in its own right.
Scoring progress: the weighted checklist
A checklist is more useful when it produces a number you can track over time. In the template, each control has a priority weight (3 = critical, 2 = important, 1 = good practice) and a status worth a fraction of that weight:
Status factor: Yes = 1 · Partial = 0.5 · No = 0 · N/A = excluded
Control score = weight × status factor
% compliance = sum of control scores ÷ sum of weights of applicable controlsIn Excel, if weights are in column E, statuses in column F and scores in column G, the formulas look like this:
G2: =IF(F2="Yes",E2,IF(F2="Partial",E2*0.5,0))
Applicable weight: =SUMIF(F2:F25,"<>N/A",E2:E25)
% compliance: =SUM(G2:G25)/SUMIF(F2:F25,"<>N/A",E2:E25)Excluding N/A matters: a store that never handles card data shouldn't lose points for a card-security control.
Case: Queen City Tax & Accounting, Charlotte
This fictional 12-person firm in Charlotte, North Carolina, falls under the FTC Safeguards Rule. The owner scored 12 essential controls on day one:
| Control | Weight | Day 1 | Score | Day 90 | Score |
|---|---|---|---|---|---|
| MFA on email and remote access | 3 | No | 0 | Yes | 3 |
| Password manager for all staff | 2 | Partial | 1 | Yes | 2 |
| Automatic updates on all devices | 3 | Partial | 1.5 | Yes | 3 |
| Offline backups, restore tested | 3 | No | 0 | Yes | 3 |
| Full-disk encryption on laptops | 3 | Yes | 3 | Yes | 3 |
| Inventory of devices, software and data | 2 | No | 0 | Yes | 2 |
| Security awareness training | 2 | Partial | 1 | Partial | 1 |
| Written Information Security Plan | 3 | No | 0 | Yes | 3 |
| Call-back rule for payment changes | 2 | Yes | 2 | Yes | 2 |
| Incident response plan and contacts | 2 | No | 0 | Yes | 2 |
| No admin rights on daily accounts | 2 | No | 0 | Partial | 1 |
| SPF, DKIM and DMARC | 1 | Partial | 0.5 | Partial | 0.5 |
| Total | 28 | 9 | 25.5 |
The owner named the office manager as Qualified Individual, hired a managed IT provider for patching and backups, and used IRS Publication 5708 to write the WISP. Training and admin rights were still "Partial" at day 90 and went on the next quarter's list.
From 9 of 28 points (32.1%) to 25.5 of 28 (91.1%) in one quarter.
2. A business scores four controls: MFA (weight 3, Yes), backups (weight 2, Partial), training (weight 2, No) and DMARC (weight 1, Yes). What is its % compliance?
Scores: 3 + (2 × 0.5) + 0 + 1 = 5. Total weight: 3 + 2 + 2 + 1 = 8. 5 ÷ 8 = 62.5%.
3. You can only do one thing this week at a 6-person office with no security controls at all. Which gives the most protection for the effort?
MFA on email blocks most account takeovers and much business email compromise, costs little and takes hours, not weeks. Policies and new hardware come later in the plan.
Common mistakes
"Our IT guy handles security."
Name a responsible person, put the plan in writing and review it with the owner every quarter.
Buying tools before knowing what you have.
Inventory devices, accounts and data first. You can't protect what you don't know exists.
Giving everyone admin rights "to avoid IT tickets."
Use standard accounts for daily work; admin rights only when installing approved software.
Forgetting vendors and contractors.
List who has access to your systems and data, require MFA and remove access when the work ends.
4. What is the main purpose of a Written Information Security Plan (WISP) for a tax practice?
The WISP is the written program: the coordinator, risk assessment, safeguards, vendor oversight, training and how the plan is reviewed. It documents controls; it doesn't replace them.
Practice exercise
A 6-person real estate brokerage in Tampa scores itself: MFA on email (weight 3, Yes), backups (weight 3, Partial), automatic updates (weight 2, No), phishing training (weight 2, Yes), card data security (weight 2, N/A: they never take card payments), incident response plan (weight 1, No). Calculate its % compliance, then list its next three actions in priority order.
See solution
Applicable weight: exclude the N/A control: 3 + 3 + 2 + 2 + 1 = 11.
Score: 3 + (3 × 0.5) + 0 + 2 + 0 = 6.5.
% compliance: 6.5 ÷ 11 = 59.1%. (If you had wrongly counted the N/A control, you'd get 6.5 ÷ 13 = 50%, unfairly penalizing the firm.)
Next actions: 1) finish backups (weight 3, half done): add an offline or immutable copy and test a restore; 2) turn on automatic updates on every device (weight 2, zero today, quick to fix); 3) write a one-page incident response plan with phone numbers for the IT provider, insurer, bank and an attorney. Real estate firms handle large wire transfers, so they should also add the payment call-back rule to the checklist.
Summary
- Small businesses face the same four incidents again and again: BEC, ransomware, account takeover and lost devices.
- Check which rules apply: the FTC Safeguards Rule (including tax preparers), HIPAA, PCI DSS and state breach laws.
- A 90-day plan covers the essentials: an owner and inventory, MFA and updates, backups and least privilege, then policy and incident readiness.
- A weighted checklist turns progress into a number: % compliance = score ÷ applicable weight, with N/A excluded.
- Re-score every quarter; security is a routine, not a one-time project.
Next lesson: Risk Management and the NIST Cybersecurity Framework. You'll score risks by likelihood and impact, calculate expected annual losses and organize your program with the six functions of NIST CSF 2.0.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.