A cybersecurity plan does not have to be a binder full of policies nobody reads. For a small business, it is a short written record of three things: what you own, how it is protected, and who does what when something goes wrong. That is enough to turn scattered habits into a system you can actually maintain.
The guidance published for small businesses keeps landing on the same handful of foundations. Take stock of your equipment and data. Secure your devices. Secure your network. Protect your accounts. Back everything up. Then prepare for the day something breaks through. The six steps below follow that order, with the practical detail a shop, clinic, restaurant, or construction office in the Upper Peninsula actually needs.
Step 1: Take stock of your devices, accounts, and data
You cannot protect what you have not counted. Get Cyber Safe’s quick guide for small business opens with exactly this step, and it is the right place to start. Set aside an afternoon and write down every piece of technology your business depends on, including the boring items people forget.
- Computers, laptops, tablets, and phones used for work, including owner devices
- Printers, scanners, and any equipment connected to your network
- Routers, modems, switches, and wireless access points
- Security cameras and smart devices on the same network
- Business phone systems, including desk phones and softphone apps
- Cloud accounts: email, file storage, accounting, scheduling, payment processing
- Your website and the company or contractor who manages it
Next to each item, note who has access and where the sensitive information lives. Client records, payroll files, medical information, and payment details deserve the most attention. Keep this list somewhere secure and update it when you buy equipment or change providers. An inventory that is six months stale will mislead you during an emergency.
Step 2: Secure your devices and keep them patched
Devices are the front door, and an unpatched door is an open one. Regular updates and patch management sit at the top of most published cybersecurity strategies for small and midsize businesses for good reason: they close known weaknesses before someone exploits them.
Turn on automatic updates for operating systems, browsers, and business software, then confirm the updates are actually installing rather than waiting for a restart that never happens. Remove software you no longer use, because every extra program is another thing to maintain. Require screen locks and full-device encryption on laptops and phones that leave the building. Limit administrator rights so that everyday accounts cannot install software or change system settings.
This step also covers the devices nobody thinks of as computers. A camera system or a networked printer running outdated firmware is still an open door. When a device reaches the end of its supported life, plan to replace it rather than leaving it connected.
Step 3: Protect your online accounts with strong password policies
Most small business breaches begin with a stolen or guessed credential. A written password policy, even a short one, changes behavior across the whole team. Require unique passwords for every account, ban password sharing between employees, and provide a password manager so people are not forced to memorize twenty logins or write them on a sticky note.
Turn on multi-factor authentication wherever it is offered, starting with email, banking, and any account that holds client data. Email deserves priority because a compromised inbox lets an attacker reset passwords on everything else. Review who has access to each account on a schedule, and remove former employees and old contractors immediately when they leave. Shared logins should be replaced with individual accounts so you can see who did what and cut off one person without disrupting everyone else.
Step 4: Secure your network and your website
Your network carries every payment, client file, and phone call in the building. Change the default administrator credentials on your router and wireless equipment, since factory passwords are widely known. Use modern encryption on your wireless network and put guest devices, personal phones, and visitor laptops on a separate guest network so they never touch the systems holding business data.
Secure the public face of the business as well. If your website collects information from customers, it needs a valid SSL certificate so traffic between the visitor and your site is encrypted. That same certificate is what browsers look for before showing a site as secure. Confirm who renews it and when, because an expired certificate turns away customers and makes your business look careless. Keep a firewall active on the network edge and on individual devices where it is available.
Step 5: Build a backup system and a business continuity plan
Backups are the difference between a bad week and a closed business. Set up automatic backups for the files, databases, and cloud accounts that would stop you operating if they vanished. Keep more than one copy, and keep at least one copy separated from your main network so ransomware cannot encrypt the originals and the backups in the same sweep.
A backup you have never tested is only a hope. Restore a few files on a schedule and confirm they open correctly. Then write the business continuity plan: what you do in the first hour, who handles phones and customers, which tasks can run on paper, and who calls your IT support. A well-crafted business continuity plan helps a small business minimize the impact of a cyberattack and recover quickly. Include contact details for your bank, insurer, key vendors, and technology provider, and keep a printed copy somewhere outside the network.
Step 6: Protect sensitive data, train your team, and plan your response
Technical controls only go as far as the people using them. Give staff a short, plain-language briefing on the tricks they will actually see: fake invoices, delivery notices, payroll change requests, and messages that pressure someone to act fast. Train new hires during onboarding and repeat the message at least once a year. Make it easy to report a mistake without fear, because a fast report limits damage while a hidden one compounds it.
Define your response in advance. Decide who leads, who talks to customers, and who contacts your IT provider and insurer. Keep client and sensitive business data limited to the people who need it, and know where the copies live so you can answer questions honestly if something leaks.
| Step | Core action | Owner |
|---|---|---|
| 1. Take stock | Inventory devices, accounts, data, and access | Owner with IT support |
| 2. Secure devices | Updates, patching, encryption, limited admin rights | IT support |
| 3. Protect accounts | Password policy, multi-factor authentication, access reviews | Owner and managers |
| 4. Secure the network | Router credentials, guest network, firewall, SSL certificate | IT support |
| 5. Back up and plan | Automatic backups, restore tests, continuity plan | Owner with IT support |
| 6. Train and respond | Staff briefing, data limits, written response roles | Owner and all staff |
How to keep the plan alive after you write it
Treat the plan as a living document with a review date. Revisit it once a year, after any significant change such as new staff, new software, a move, or a new location, and after any close call. Guidance on a minimum baseline of cybersecurity for small business emphasizes steady improvement in posture rather than a single perfect setup, so pick the weakest area each year and fix it.
Frameworks exist if you want a structured reference. The approach used in many small and midsize business whitepapers follows the Framework for Improving Critical Infrastructure Cybersecurity, organized around identifying, protecting, detecting, responding, and recovering. You do not need to adopt the whole framework to benefit from its shape. The six steps in this article already map onto it.
Where local IT support fits in
Some owners handle steps one and three themselves and hand off the rest. Others want the entire plan installed, monitored, and reviewed by someone who knows the building. For businesses in Marquette and across the Upper Peninsula, Superior Eagle provides managed IT services, business phone systems, security cameras, and structured wiring, and works with small teams that need practical protection without enterprise complexity. A local provider can keep patching on schedule, test backups, watch the network, and answer the phone when a staff member clicks something they should not have.
Start with the inventory. Write down what you own, fix the two weakest points you find, and put a review date on the calendar. That first round of work does more for your business than a plan nobody revisits.
Frequently Asked Questions
How long should a small business cybersecurity plan be?
Short enough that you actually use it. A few pages covering your device inventory, account rules, network setup, backup routine, and response contacts will serve most small businesses well. Length is not the goal. Clarity is, especially when someone needs to follow the plan during a stressful afternoon rather than read it for pleasure.
Who should be responsible for cybersecurity in a small company?
The owner sets priorities and budget, but one person should be named as the day-to-day contact for technology issues. In very small teams that may be the owner or an office manager working alongside an outside IT provider. What matters is that the responsibility is written down, so questions do not stall while everyone assumes someone else is handling it.
What is the first thing to fix if we have no budget for security tools?
Start with updates and account hygiene, both of which cost time rather than money. Turn on automatic patching, give every employee a unique password through a password manager, and enable multi-factor authentication on email and banking. Those changes block a large share of the attacks small businesses encounter, and they build the habit of maintaining the plan.
Do we need a written continuity plan if we already have backups?
Yes. Backups restore files, but a continuity plan tells people what to do while systems are down. It covers who answers the phones, which tasks move to paper, how customers are notified, and who calls your IT provider. Businesses that plan ahead minimize the impact of an attack and recover faster than those improvising in the moment.
How often should we review the plan?
Once a year at minimum, plus after any major change such as new staff, new software, a new location, or a security incident. Many owners also review it before renewing insurance or after a supplier reports a breach. Steady small improvements each cycle beat an ambitious rewrite that never gets finished.