One of the most common things I hear from small business owners and nonprofit leaders is some version of this: "I know we need to do something about security. I just don't know where to start."
That paralysis is understandable. Search "small business cybersecurity" and you will find articles recommending twenty tools, a dedicated security team, annual penetration tests, and a SIEM. None of that is realistic if you have six employees and no IT department.
What follows is a sequenced starting point. Five steps, ordered by impact. Each one is practical for an organization without dedicated security staff, and most of them cost nothing. The goal is not to build an enterprise security program. The goal is to close the gaps that account for the overwhelming majority of successful attacks against organizations like yours.
You cannot protect what you have not identified. The first step in any practical security program is a simple inventory: what data does your organization hold, where does it live, and what would happen if it were lost, stolen, or locked by ransomware?
You do not need specialized software for this. A shared spreadsheet is fine. The goal is to surface answers to three questions: What information would cause the most damage if exposed? What systems would bring operations to a halt if they went offline? And who currently has access to each of those things?
For most small organizations this exercise reveals two things immediately. First, there are systems and accounts that are far more critical than others, which tells you where to focus your next steps. Second, there are almost always accounts or access grants that no longer make sense, which you will address in Step 3.
- List every system your organization depends on: email, accounting software, donor or CRM database, file storage, website, banking portal.
- For each one, note: what data it holds, who has access, and what breaks if it goes down for a week.
- Identify the two or three that would be most damaging to lose. Those are your highest-priority targets for the steps that follow.
Most attacks against small organizations start with a stolen or guessed password. The attacker does not break in. They log in. Multi-factor authentication (MFA) is the single highest-return security action available to you, and for most platforms it costs nothing to enable.
Microsoft's own data shows that more than 99.9% of compromised accounts do not have MFA enabled. That means an attacker who gets hold of a staff member's email password still cannot access the account if MFA is on, because they do not have the second factor. One extra step at login stops the overwhelming majority of credential-based attacks cold.
Start with email. Email is the master key to almost everything else in your organization. If an attacker gets into a staff member's inbox, they can reset passwords for your accounting software, your banking portal, and your cloud file storage. Protecting email with MFA is not optional, it is foundational.
After email, work through the list you built in Step 1. Every critical system that supports MFA should have it enabled, prioritized by how damaging a compromise would be.
- Enable MFA on all staff email accounts today. Microsoft 365 and Google Workspace both include this at no additional cost. Use an authenticator app (Microsoft Authenticator or Google Authenticator) rather than SMS where possible, as SMS is slightly easier to intercept.
- Enable MFA on your accounting or financial systems, your banking portal if supported, and your cloud file storage.
- Make MFA enrollment a condition of access for new staff and contractors from this point forward.
Every organization accumulates access over time. Former employees whose accounts were never fully deactivated. A contractor who was given admin rights for a project three years ago. A vendor who still has a login to your file system from an engagement that ended. A shared password that ten people know because it was easier than setting up individual accounts.
Each of these is an open door. Attackers specifically look for stale accounts and overprivileged credentials because they carry the implicit trust of a real person without the risk of that person noticing unusual activity on their account.
This step is about reducing your attack surface to only what is actively needed. The principle at work here is called least privilege: people and systems should have access to exactly what they need for their current role, and nothing more. You do not need to understand the technical concept to apply it. You just need to ask a simple question for each account you find: does this person still need this access, at this level, right now?
- Pull the user list from your email system, your accounting software, and your file storage. Disable or delete any account belonging to someone who no longer works with your organization.
- Identify any admin or elevated-privilege accounts. Confirm that each one genuinely requires that level of access today. Downgrade anything that does not.
- If you use shared passwords for any system, rotate them now and create individual accounts where the platform supports it.
- Set a calendar reminder to repeat this review every six months.
Ransomware encrypts your files and demands payment for the key. The organizations that pay ransoms are almost always the ones without functional, tested backups. The organizations that recover without paying are the ones that can restore from a copy the attacker never reached.
The practical standard for backups is called the 3-2-1 rule. Three copies of your data. Stored on two different types of media. With one copy kept offsite (or in the cloud, in a location separate from your primary systems). The reasoning behind the third copy being offsite is exactly what ransomware exploits: if the attacker can reach your network, they can often reach anything connected to it, including a backup drive plugged into the same system.
The most important word in that rule is "tested." A backup that has never been restored is an assumption, not a safety net. You need to know that your backup actually works before you need it, not after.
- Identify what data is genuinely critical: the files you could not rebuild from scratch if everything disappeared tomorrow. This list is likely shorter than you think.
- Set up an automated cloud backup service for that critical data. Backblaze Business Backup and similar services run $7–$9 per computer per month. For most small organizations, this is a reasonable and well-supported option.
- Test a restore. Actually retrieve a file from your backup and confirm it works. Do this today, not when you need it.
- Make sure at least one backup copy exists somewhere the attacker cannot reach from your network: a cloud backup with a separate login credential, or an external drive stored offsite.
The worst time to decide what to do during a security incident is while it is happening. Stress, time pressure, incomplete information, and competing priorities all conspire to produce bad decisions. A simple plan made in advance, even a one-page document, breaks the paralysis and gives everyone a starting point.
Your plan does not need to cover every scenario. It needs to answer four questions: Who decides? Who do we call? What do we tell our clients or stakeholders, and when? And what do we preserve as evidence?
The decision-maker question matters more than most organizations realize. During an incident you will be asked whether to disconnect systems, whether to pay a ransom, whether to notify clients before you know the full scope of the breach. These decisions need a named person with authority to make them. If that is not established in advance, the decision either does not get made or gets made by the wrong person under pressure.
- Write down: who is the decision-maker if something goes wrong. If you have a board, do they need to be notified, and how quickly?
- List the phone numbers you would need in an emergency: your IT vendor or managed service provider, your cyber insurance carrier if you have one, your attorney, and your bank's fraud line.
- Write one sentence about what you owe clients or stakeholders in the event of a breach. Many states have breach notification laws with specific timing requirements. Know yours before you need to apply them.
- Keep the document somewhere people can find it when systems may be down: a printed copy in a desk drawer works.
What this gets you
These five steps do not make your organization invulnerable. Nothing does. What they do is close the gaps that account for most successful attacks against organizations like yours.
Identity-based attacks, the kind where an attacker uses stolen credentials to log in rather than break in, represent the leading cause of breaches across every sector. Steps 2 and 3 directly address this. Ransomware, the attack that forces organizations to choose between paying and losing everything, is dramatically less threatening to an organization with clean, tested, offsite backups. Step 4 addresses this. Business email compromise, which you read about last week, depends on impersonating trusted relationships through email. Steps 2 and 3 reduce the attacker's ability to compromise an account to impersonate from. And when something does go wrong despite all of this, Step 5 is the difference between a contained incident and a chaotic one.
When these five steps are done
Completing these steps puts your organization in a meaningfully better position than the majority of small businesses and nonprofits operating today. That is not a high bar, but it is a real one. Most attacks are not sophisticated. They are opportunistic. They succeed because of open doors that could have been closed.
Once these five steps are in place, the natural next questions are: Do we understand what our highest-risk exposures are? Are we meeting any compliance requirements relevant to our sector? And how would we actually know if something was wrong? Those questions are the beginning of a more mature security program, and they are worth asking after the foundation is solid.
If you are not sure where your organization stands after working through this list, or if you want a clearer picture of your risk before you start, a structured assessment is the right next step. Not to produce a report that sits on a shelf, but to give you the specific, prioritized information you need to make good decisions.
Not sure where to start, or how far you've gotten?
A 30-day Security Business Review gives you a clear picture of your highest-priority gaps and a practical roadmap you can act on. No enterprise complexity. No vendor pitches. Just defensible decisions.
Start a Conversation