Most small-business incidents start with a stolen password, a phishing email, a missed update or a missing backup. Ten steps close those doors: password manager, two-step sign-in, tested backups, automatic updates, email protection, access cleanup, device encryption, a team briefing, an AI rule, and a written incident plan.
Industry reports such as Verizon's annual Data Breach Investigations Report consistently show ransomware and stolen credentials among the leading causes, and show smaller organizations affected disproportionately. Check the primary report for current figures.
- Use a password manager for every shared and personal business login.
- Turn on two-step sign-in (MFA) for email first, then banking, cloud storage and accounting. Prefer an authenticator app over text messages.
- Back up automatically to somewhere off the computer, keep versions, and test a restore.
- Enable automatic updates on computers, phones and the router. Replace devices that no longer get updates.
- Protect email: use the built-in spam and phishing filters, and set up SPF, DKIM and DMARC for your domain.
- Clean up access: list who has admin rights, remove former staff the same day, stop sharing logins.
- Encrypt laptops and phones and know how to wipe a lost one.
- Brief your team for 20 minutes on phishing and who to tell after a wrong click.
- Write an AI rule: no customer data or secrets in free consumer AI tools. See the one-page policy.
- Write a one-page incident plan: who to call, what to disconnect, where backups live, and who to notify.
A note on the law
North Carolina's Identity Theft Protection Act requires businesses that hold residents' personal information to notify affected people after a security breach, and vendors holding data for others must notify the data owner. Read the details on the NC Attorney General's page. This is general information, not legal advice.
Want help with these?
The $495 Security Checkup covers most of this list and gives you a ranked fix list.
See the Security Checkup