# Cybersecurity basics every small business should have > The security basics federal agencies recommend for small businesses: MFA, strong passwords, updates, phishing awareness, tested backups, and an incident plan. Canonical URL: https://www.whiteorange.com/insights/cybersecurity-basics-for-small-businesses Published: 2026-10-13 Topic: IT & networks Author: The whiteorange team ## The short answer Every small business should turn on multifactor authentication, use strong unique passwords with a password manager, keep software updated, and teach staff to recognize phishing. These are the core steps CISA recommends. Add tested backups kept separate from your network and a simple written plan for what to do when something goes wrong. ## Why do small businesses need cybersecurity basics? Online fraud and cyberattacks reach businesses of every size, including small ones. The FBI’s Internet Crime Complaint Center (IC3) received **1,008,597 complaints** in 2025, with reported losses of **$20.877 billion**, according to its 2025 annual report. Business email compromise, where criminals impersonate a colleague or supplier to redirect payments, accounted for about **$3.05 billion** of those 2025 losses, second only to investment fraud. Closer to home, the same report lists 14,699 complaints from South Carolina in 2025, with about $264 million in reported losses. The good news is that the most effective protections are well understood and affordable. CISA, the FTC, and NIST all publish free guidance written for small businesses, and the basics below draw on it. ## What are the four essentials CISA recommends? CISA’s [Secure Our World](https://www.cisa.gov/secure-our-world) program and its guidance for small and medium businesses start with four steps. They apply to every business, whatever its size. - **Turn on multifactor authentication (MFA).** MFA means using more than a password to sign in, such as a code or an app prompt. Start with email, banking, payroll, and remote access. - **Use strong passwords and a password manager.** Every account should have a long, unique password. A business password manager makes that practical and lets you share access safely. - **Update software.** Turn on automatic updates for operating systems, browsers, and apps, and do not put off the ones that need a restart. - **Recognize and report phishing.** Teach staff to pause on unexpected messages that ask them to open a file, click a link, share information, or change payment details. ## How do you protect against payment and email fraud? Many of the costliest attacks start with a convincing email. A message appears to come from your CEO, a vendor, or a customer, asking for a wire transfer or new bank details. MFA on every mailbox makes it much harder for criminals to take over a real account. Put a simple rule in writing: any request to change payment details or send money urgently gets confirmed by phone, using a number you already have on file. Never use contact details from the email itself. Share this rule with your bank, key vendors, and anyone on your team who handles money. The FTC’s small business guidance also recommends email authentication tools (SPF, DKIM, and DMARC) that make it harder for scammers to send email that looks like it came from your domain. ## What should your backup plan look like? Backups are what let you recover from ransomware, a failed server, or an honest mistake. CISA recommends keeping offline, encrypted backups and testing them regularly, and describes the 3-2-1 approach: three copies of important data, on two types of storage, with one kept off-site. The FTC adds that backups should not stay connected to your network, so an attack on your systems cannot also reach your copies. Cloud email and file storage need backing up too, since deleted or encrypted files can sync across every device. Until you have restored from a backup, you cannot be sure it works. Schedule test restores and write down how long they take. ## What is an incident plan, and does a small business need one? An incident plan is a short document that says who does what when something goes wrong. CISA’s small business guidance lists having an incident response plan, and being prepared for system disruptions, among its recommended practices. It also advises naming a response team covering technology, communications, legal, and business continuity. Planning ahead matters because the first hour of an incident is stressful and confusing. Decisions about who to call, whether to shut systems down, and what to tell customers are easier when they have already been made on paper. For a small business, one or two pages is enough. Include: - Who to call first, including your IT provider, bank, insurer, and attorney - How to disconnect affected devices without deleting evidence - Where backups are and who can restore them - How to report incidents, including to CISA and to the FBI at ic3.gov - Who speaks to staff and customers, and what they can say ## What else should be on the list once the basics are in place? Once the essentials are covered, CISA’s next steps include turning on logging for business systems and encrypting business data, especially on laptops that leave the office. Remove accounts for people who have left, and review who has admin rights at least a few times a year. Vendors deserve a look too. The FTC points out that vendors may have access to sensitive information about your business or customers, so ask how they protect it and limit their access to what they need. ## How do you put this into practice? Start with an honest inventory. List your accounts, devices, and where your important data lives. Then check each one against the four essentials, confirm your backups can be restored, and write the first draft of your incident plan. Small, steady steps matter more than a perfect plan that never gets finished. Three free government resources are written with small businesses in mind and make good checklists: CISA’s [Secure Your Business](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business) page, the FTC’s [Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/resources/cybersecurity-small-business) guide, and NIST’s [Small Business Cybersecurity Corner](https://www.nist.gov/itl/smallbusinesscyber), which covers the NIST Cybersecurity Framework, ransomware, phishing, and more. If you would rather have help, whiteorange’s [managed IT services](https://www.whiteorange.com/managed-it-services) cover security basics, patching, and tested backups as part of an agreed scope, documented so you always know what is in place. Our [network support](https://www.whiteorange.com/business-network-support) covers firewalls and Wi-Fi. A good starting point is the free [Business Opportunity Assessment](https://www.whiteorange.com/audit), or you can call our Greenville office at 864.383.2278. ## Common questions ### What are the most important cybersecurity steps for a small business? Turn on multifactor authentication, use strong unique passwords with a password manager, keep software updated, and train staff to recognize phishing. Then add tested backups and a written incident plan. ### Does a small business really need an incident response plan? Yes. CISA recommends having an incident response plan and using it. For a small business, a one- or two-page document listing who to call and what to do first is a practical start. ### How should a small business back up its data? Follow the 3-2-1 approach CISA describes: three copies, on two types of storage, with one off-site. Keep backups disconnected from the network and test restores regularly. ### Where can I report a cyber incident? You can report incidents to CISA and to the FBI’s Internet Crime Complaint Center at ic3.gov. Also contact your bank right away if money was sent. ## Sources - [Secure Our World](https://www.cisa.gov/secure-our-world), Cybersecurity and Infrastructure Security Agency (CISA) - [Secure Your Business](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business), Cybersecurity and Infrastructure Security Agency (CISA) - [Level Up Your Defenses: Four Cybersecurity Best Practices for Businesses](https://www.cisa.gov/resources-tools/resources/level-your-defenses-four-cybersecurity-best-practices-businesses), Cybersecurity and Infrastructure Security Agency (CISA) - [Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/resources/cybersecurity-small-business), Federal Trade Commission - [Small Business Cybersecurity Corner](https://www.nist.gov/itl/smallbusinesscyber), National Institute of Standards and Technology (NIST) - [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), Federal Bureau of Investigation, Internet Crime Complaint Center whiteorange is a business improvement partner based in Greenville, South Carolina, with 25 years of experience. We help businesses find what matters, improve how work gets done, and keep getting better. Address: 914 Pendleton Street, Suite 300b, Greenville, SC 29601 Phone: 864.383.2278 Contact: https://www.whiteorange.com/audit Hours: Monday–Friday 8:30am–5:30pm; Saturday 12pm–4pm (Greenville local time). Website: https://www.whiteorange.com How we work: Understand → Improve → Grow. Service areas include Greenville, Anderson, Spartanburg, Greer, Travelers Rest, Easley, Powdersville, Clemson, Pickens, and Six Mile, South Carolina. whiteorange has one stated office in Greenville; service-area pages do not represent additional branches.