| John Bosman | 1,176 words
New year, new resolutions. Add these 10 cyber security resolutions to your list to reduce your data exposure in the year ahead. This is a once-a-year reset for a small business: review what you keep, who can reach it and whether you can rely on your safeguards in an incident. The FBI's 2025 IC3 Internet Crime Report recorded $20.877 billion in reported losses, up 26% from 2024. For the work that follows this reset, see how a cyber hygiene routine keeps controls working; to understand the threat patterns behind it, see the cyber threats small businesses should recognize. If the foundation is not in place, start with the one-time cyber setup checklist.
Short answer
A yearly cyber reset helps a small business reduce unnecessary data, close access that no longer has an owner, test recovery and compare actual controls with what the business says it has. The goal is not a perfect security program. It is a documented set of choices that is easier to maintain and defend.
Reader checkpoint
- Do we still hold customer or employee data we no longer need?
- Does anyone who left last year still have access to email, banking, payroll or shared drives?
- When did we last test restoring from backup, end to end?
Quick answer
Use the new year to prove the basics still work.
Treat the reset as a short review with owners, dates and evidence. The most useful resolutions remove forgotten exposure, test the controls the business would need in a real incident and create a clean record for the next renewal conversation.
At a glance
What to identify before the next decision
| Main issue | Old data and old access can survive long after the business reason for them ends. |
|---|---|
| Common blind spot | Data you no longer need is still data you can lose, and still data you may have to report if it is breached. |
| Useful document | A current data and access inventory, backup restore record, vendor list and cyber application. |
| Best next step | Assign an owner and due date to each resolution, then keep the proof with the renewal file. |
1. Delete data you no longer need
Old customer files, former-employee records and forgotten exports can create exposure long after they stopped being useful. Delete or securely dispose of information that is past any retention requirement that applies to your business.
Done when: you have a documented retention rule and a completed cleanup list for the records it covers.
2. Re-inventory where sensitive data lives
Make a current list of the systems, shared drives, vendors, laptops and cloud accounts that hold customer, employee, financial or operational data. The list should say who owns each place and what kind of information is there.
Done when: you can point to one current inventory instead of reconstructing it during an incident.
3. Remove old access and review administrator rights
Start with people who left, changed roles or no longer need a system. Then review who has administrator rights, because an everyday account with unnecessary privileges can turn a small compromise into a larger one.
Done when: every active account has an owner and every administrator role has a current business reason.
4. Rotate shared and administrator passwords
Shared passwords and administrator credentials deserve a deliberate review at least once a year and whenever responsibility changes. Move them into a business password manager so access can be granted, removed and audited without passing credentials through email or chat.
Done when: shared and administrator credentials are unique, stored in the manager and assigned only to current users.
5. Review vendors and their access
Outside vendors may retain logins, remote access or copies of business information after a project ends. Confirm which vendors still need access, what they can reach and how the relationship handles data when service ends.
Done when: you have removed unused vendors and documented the access that remains.
6. Retire unsupported devices and software
Devices and software that no longer receive security updates become harder to defend over time. Identify what is unsupported, plan a replacement or retirement path and make sure the inventory reflects the decision.
Done when: the inventory identifies every unsupported item and the owner, date and plan for removing it.
7. Test a full restore from backup
A backup is not proven until the business can restore a system, its settings and the data people need to work. Test an end-to-end restore, record what took time and fix the gaps before a real incident creates urgency.
Done when: a full restore has been tested, the result is documented and the recovery steps are available offline.
8. Update the incident response contact list
Keep current contacts for IT, the insurer claims line, breach counsel or coach, the bank and key vendors. Put the list somewhere people can reach if email, phones or the main network are unavailable, and print a copy for the incident file.
Done when: the contact list has named owners, current numbers and an offline copy.
9. Refresh team training for urgent requests
Ask the team to slow down when a payment change, payroll request or urgent message arrives. Practice verifying the request through a known channel and reporting a suspicious message without blame.
Done when: the team knows the verification rule and where to report a concern.
10. Re-read your cyber policy before renewal
Compare the controls you actually use with the answers on the last cyber application. Those answers are representations about the business, so they should match reality; for the policy discussion, see how cyber insurance responds to a covered digital event.
Done when: the policy, application answers and documented controls have been reviewed together before renewal pressure arrives.
Defined Q&A
Questions about an annual cyber reset
Why make cyber resolutions at the start of the year?
A yearly reset creates a practical time to remove stale access, verify what changed and assign owners before a renewal or incident makes the work rushed. The calendar matters less than choosing a consistent time and recording what was reviewed.
What is data minimization and why does it reduce risk?
Data minimization means keeping only the information the business needs, for only as long as it needs it. Fewer unnecessary records, copies and accounts can reduce what is exposed if a system, vendor or device is compromised.
How do these resolutions affect cyber insurance?
Cyber applications and renewals often ask about access, backups, training and incident planning. Accurate, documented answers can make the coverage conversation clearer, but they do not promise eligibility, pricing or a particular claim outcome.
A useful reset is not a list that disappears after January. Keep the inventory, access review, restore test and contact list where the people responsible for them can find and update them.
If the reset uncovers a gap, start with the evidence: what changed, who owns the fix and how the business will verify it. That produces a better security and insurance conversation than a last-minute assumption.
What to do next
Use the Commercial Renewal Readiness Score to organize the renewal conversation, then start a coverage review if the reset exposes a question about cyber limits, conditions or response services.
Commercial Renewal Readiness Score | Start a Coverage Review | Cyber Liability Insurance