| John Bosman | 1,195 words
Most small businesses have some protections but never finished setting them up. These 10 steps are the one-time foundation. Once they're in place, the hygiene routine keeps them working. For the threats behind each step, see what these steps protect against.
Short answer
The essential setup steps are MFA on every critical account, a team password manager, limited admin rights, a device and account inventory, endpoint protection, tested and separated backups, email authentication, a payment-verification rule, a secured network and remote access, and a written incident plan. Most can be done in a few weeks without a dedicated IT department. They are also the controls cyber insurance applications commonly ask about.
Reader checkpoint
- Could you list every device, account and system your business uses, and who has admin access to each?
- If your bank details were changed by email tomorrow, is there a written rule that requires a callback before anyone pays?
- If you were hit with ransomware tonight, do you know the first three calls to make, and is that list stored somewhere you could reach offline?
Quick answer
Set the foundation once, then maintain it.
Set these up once, in order, and write down when each is done. Then hand them to the routine so they stay done. The aim is not a perfect security program; it is a verified foundation that a small team can keep current.
At a glance
What to identify before the next decision
| Main issue | Controls that were started but never finished: MFA on some accounts, backups that were never tested, and admin rights everyone still has. |
|---|---|
| Common blind spot | Answering “yes” on a cyber application because a tool was bought, even though it was never fully set up. |
| Useful document | A one-page setup log: each step, date done, who owns it, and what was covered. |
| Best next step | Use the Commercial Renewal Readiness Score. |
1. Turn on MFA for every critical account
MFA makes a stolen password less useful because the person logging in must provide another factor. Start with email, then banking, payroll, remote access, cloud storage and administrator accounts. Where available, prefer an authenticator app or passkey over text-message codes.
Done when: no critical account can be logged into with a password alone.
2. Roll out a team password manager
A shared password manager gives the business a controlled place for credentials instead of leaving them in individual inboxes or memories. Move shared passwords into it, change them, and give people only the access they need.
Done when: no passwords live in spreadsheets, sticky notes or group chats.
3. Limit admin rights
Daily work should happen on standard accounts. Only named people should hold administrator accounts, and those accounts should be used only for administrator tasks; that reduces what a compromised everyday account can change.
Done when: you can name every admin and each has a separate admin login.
4. Build an inventory
You cannot protect or retire what no one can name. List devices, software, cloud accounts, vendors with access, and where sensitive data lives. The list also gives an IT provider and insurance reviewer a concrete starting point.
Done when: you have one list, with an owner who keeps it updated.
5. Install endpoint protection and automatic updates
Detection and response tools can help identify suspicious activity on computers and servers, while updates close known weaknesses. Put endpoint protection on every computer and server, then turn on automatic updates where they are practical.
Done when: every device on the inventory shows protection active and updates on.
6. Set up backups that survive an attack
Backups matter only if an attacker cannot easily reach them too. Use the 3-2-1 approach—three copies, two types of storage, and one kept offline or separated from the network—and write down how to restore. Ransomware often goes after backups first, which is why the separation matters.
Done when: a full restore has been tested once and the steps are written down.
7. Secure your email domain and filtering
Email is where many payment and login problems begin. Turn on SPF, DKIM and DMARC, the built-in phishing and attachment protection in Microsoft 365 or Google Workspace, and external-sender warnings so staff have useful signals before they act.
Done when: your IT provider or email administrator confirms all three records and the filters are on.
8. Write a payment-verification rule
Any new or changed bank details, or any urgent payment request, should be confirmed by calling a known number—not a number in the message. Add dual approval above a dollar threshold you choose. Deepfakes and trusted-looking requests make that simple rule more important.
Done when: the rule is written, shared with everyone who can move money, and your bank’s settings match it.
9. Lock down your network and remote access
Change default router and device passwords, keep guest Wi-Fi separate from business systems, turn off remote desktop that is not needed, and require MFA for any remaining remote access. These choices make the network less open before an incident tests it.
Done when: no device uses a default password and remote access only works with MFA.
10. Write an incident response plan
Keep the plan to one page: who decides, who to call—your IT provider, your insurer’s breach hotline or agent, and your bank—and where the policy number is stored offline. Include an offboarding checklist for departing employees and vendors.
Done when: the plan is printed, stored offline, and the key people have read it.
How these steps line up with your cyber insurance
Cyber applications and renewals commonly ask about MFA, backups, endpoint protection, email security, admin access and incident planning. Those answers are representations about your business. Answer based on what is actually set up, not what was purchased or planned.
Many cyber policies include a breach hotline and may require notice to the insurer before outside vendors are hired. Check your policy and put that number in the incident plan from step 10. Coverage, response services and requirements depend on the policy and facts; see how cyber insurance works before assuming a particular policy will respond.
Defined Q&A
Common questions about business insurance
What are the most important cybersecurity steps for a small business?
MFA, a password manager, tested backups, endpoint protection and a payment-verification rule cover the most common gaps. The remaining steps make those controls easier to administer, document and maintain.
How long does it take to set these up?
Many small businesses can work through the list in a few weeks, often with help from an IT provider. The actual time depends on the size of the team, the systems in use and how much is already configured.
Do these steps affect my cyber insurance?
Insurers commonly ask about these controls on applications and renewals. Answers should match what is actually in place, because inaccurate answers can create coverage problems; the effect depends on the policy and the facts.
Pick the first three steps you have not finished, assign an owner and a date, and log them as you go. Then the hygiene routine keeps them in place.
What to do next
Connect your one-time cyber setup to the way your business actually operates before a renewal, a claim, or an urgent request exposes a gap.
Commercial Renewal Readiness Score | Start a Coverage Review | Cyber Liability Insurance