Cybersecurity for Small Business: 10 Steps, in Priority Order, With Costs

Steps 1–4 are CISA’s four core steps, with the free settings first; steps 5–10 follow CISA’s additional steps for organizations and the FTC’s small business basics. The order is a priority guide, not a measured risk model. Prices are vendors’ published list prices, checked October 24, 2026.

The 10 steps of cybersecurity for small business

Each step below says what to do, what it costs, and where to compare tools if you need one.

1. Turn on multi-factor authentication

Multi-factor authentication (MFA) comes first because it stops a stolen password from opening an account, and it is free. Microsoft says MFA plus blocking old sign-in methods stops more than 99.9% of common identity attacks, and its “security defaults” turn MFA on for every user at no extra cost. The FTC tells small businesses to “require multi-factor authentication to protect sensitive information”. Start with admin and email accounts, as CISA’s Cyber Essentials advises.

2. Turn on automatic updates

Automatic updates close the software holes attackers already know about, and they cost nothing. The FTC’s advice is short: “Turn on automatic updates” for programs, apps, browsers and operating systems. Replace devices that no longer get security updates, such as old routers and phones.

3. Train staff to spot phishing

Phishing training teaches staff to stop and check before they click a link, open an attachment or pay an invoice. That matters because business email compromise, where criminals pose as a boss or supplier to redirect payments, cost victims $3.05 billion across 24,768 complaints to the FBI in 2025. CISA and the FTC publish free material; KnowBe4’s Foundation tier lists at $28.80 per user a year on AWS Marketplace for 25 to 50 users. A simple rule costs nothing: confirm any change to bank details by phone, using a number you already have.

4. Use a password manager

A password manager lets each employee use a long, unique password for every account and shares logins without sending them over email. CISA’s core steps pair strong passwords with a password manager. Business plans start at $4 per user a month for Bitwarden Teams; our business password manager comparison ranks eight plans.

5. Back up data and keep one copy offline

Backups are what let a business recover from ransomware or a stolen laptop without paying anyone. CISA advises “regular automated backups” protected with “encryption and offline copies”, and the FTC suggests the cloud or an external hard drive. Backblaze’s business backup costs $99 per computer a year with unlimited data. Test a restore now and then; a backup you can’t restore is not a backup.

6. Run business antivirus on every device

Business antivirus protects every laptop, desktop and phone from one dashboard, so you can see which device is unprotected. Microsoft Defender for Business costs $3 per user a month for up to 5 devices each, and is included in Microsoft 365 Business Premium. Our business antivirus rankings compare five plans on independent lab results and price, and our guide covers whether Windows Defender is enough on its own.

7. Set up SPF, DKIM and DMARC email authentication

SPF, DKIM and DMARC are free DNS records that stop criminals from sending email that looks like it came from your domain. The FTC explains that SPF “verifies that a mail server is allowed to send email for a given domain” and DMARC tells receiving servers what to do with fakes. Since February 1, 2024, Google requires anyone sending to Gmail to set up SPF or DKIM, and bulk senders (5,000 or more messages a day) to add DMARC. Your email provider or IT person can add all three.

8. Lock down Wi-Fi and remote access

Secure Wi-Fi means changing the router’s default admin password, using WPA3 or WPA2 encryption, and putting guests and personal devices on a separate network, per the FTC. Staff who work from public Wi-Fi or reach office systems remotely need a business VPN or zero-trust access tool; NordLayer’s Lite plan starts at $8 per user a month with a 5-user minimum. See our VPN for small business picks for others.

9. Limit admin rights and remove ex-employees’ access

Admin rights should go only to the people who need them, and accounts should close the day someone leaves. CISA’s Cyber Essentials says to grant access “based on need-to-know and least privilege” and to write procedures for changes in user status, such as terminations. Keep a list of every account each person has, including shared ones.

10. Write an incident plan and consider cyber insurance

An incident plan is a one-page list of who to call, which accounts to lock and how to restore from backup, written before you need it. CISA lists “Have an incident response plan and use it” among its steps for organizations, and the SBA points to the FCC’s free Small Biz Cyber Planner for building one. Report fraud to the FBI at ic3.gov. Cyber insurance can pay for recovery; our guide to cyber insurance for small business covers costs and what the policy wording usually excludes.

What a basic security setup costs for 5, 10 and 25 employees

A basic paid setup of cloud backup, a password manager and business antivirus costs $1,830 a year for 10 employees at published prices, assuming one computer per person.

The totals are our sums of published prices, billed annually, checked October 24, 2026. Steps 1, 2, 7 and 9 are free settings. Not included: paid phishing training, a business VPN, managed detection and cyber insurance. If you already pay for Microsoft 365 Business Premium, Defender for Business is included, so drop that column.

When to pay for outside help

Pay for outside help when nobody on staff can respond to a security alert, or when a customer, insurer or contract asks for monitoring you can’t provide yourself.

• An IT provider (MSP) handles updates, backups and accounts for businesses with no IT person.
• Managed detection (MDR) watches devices around the clock and responds to attacks; published prices start at $8.99 per endpoint a month (Huntress MSRP) and $99 per device a year (ThreatDown).
• A penetration test proves to auditors or customers that your systems hold up; see our penetration test pricing.

Our comparison of 15 managed security providers also shows what moves a quote.

The threats small businesses actually face

The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints with $20.877 billion in reported losses in 2025.

Business email compromise is the second-largest loss category in the report, behind investment fraud. IC3’s ransomware figure excludes lost business, time and equipment. The defenses are steps 1, 3 and 7: MFA, training and email authentication.

Free government cybersecurity resources for small business

US agencies publish free small business guidance, and every step on this page traces back to one of them.

• CISA Secure Our World and Cyber Essentials: the four core steps and a leader’s guide to the rest.
• FTC Cybersecurity for Small Business: basics, email authentication, remote access, vendor security and cyber insurance.
• NIST Small Business Cybersecurity Corner: guides and quick-start material from NIST and its contributors.
• SBA: training events and a list of planning tools, including the FCC’s Small Biz Cyber Planner.
• FBI IC3: where to report fraud and cyber crime.