Cybersecurity basics every small business and non-profit should have in place

Most small businesses and non-profits aren't breached by sophisticated nation-state attackers. They're breached by phishing emails, reused passwords, and unpatched software — the same handful of gaps, over and over. The good news: closing those gaps doesn't require a large security team or a six-figure budget.

1. Multi-factor authentication, everywhere it's offered

If a password is the only thing standing between an attacker and your email, your bank, or your donor database, you have a single point of failure. Multi-factor authentication (MFA) — a code from your phone, a push notification, a security key — stops the vast majority of account-takeover attempts even when a password is stolen. Turn it on for email, financial accounts, and any admin login first.

2. A password manager, not a spreadsheet

Reused passwords are how one leaked account becomes ten compromised accounts. A password manager lets your team use a unique, strong password for every system without having to remember any of them. This is a five-minute setup that closes one of the most common attack paths outright.

3. Patched software and devices

Most exploited vulnerabilities are ones vendors already fixed months or years earlier — the fix just was never installed. Automated patch management for computers, servers, and phones closes this gap quietly, in the background, without relying on staff to click "update" on their own.

4. Backups that you've actually tested

Ransomware doesn't care how good your intentions were. A backup you've never tried to restore from is a hope, not a plan. Test your recovery process at least twice a year so you know, concretely, how long it takes to get back up and running — before you're forced to find out during an actual incident.

5. Basic staff awareness training

Your team doesn't need a certification. They need to recognize a phishing email, know what to do if they click something they shouldn't have, and understand why "IT" is asking them to enable MFA. A 30-minute training session, repeated annually, changes behavior more than any single piece of software.

Where to go from here

These five items aren't a complete security program, but they close the gaps that cause the majority of real-world incidents at organizations without a dedicated security team. If you're not sure which of these you already have in place, that's exactly the kind of assessment we do first with new clients — no obligation, no sales pressure, just a clear picture of where you stand.