A small business gets the most protection from a short list of owned tasks: turn on multifactor authentication, keep software patched, back up what you cannot lose, write an incident plan, and name one person responsible. CISA's small business guidance frames these as a program with owners, not a pile of tools.
Who is responsible for security in a small company?
CISA's guidance for small businesses starts with the chief executive, not the IT team. Its reasoning is that cybersecurity is about culture as much as technology, and that organizations fall into the trap of treating security as the IT team's job alone.
The CEO's tasks in that guidance include setting security goals alongside business goals, choosing a Security Program Manager, approving the incident response plan, and joining tabletop exercises. The Security Program Manager does not need to be a security expert or an IT professional. They need to make sure the key elements happen and report progress at least monthly.
Why does CISA say old advice is out of date?
The guidance opens by saying small businesses often hear advice that is out of date or does not prevent the most common compromises. Its example is the warning never to shop online over coffee shop wi-fi. CISA says there was some truth to that a decade ago, but it is not how people and organizations are compromised today.
The shift is useful: spend effort on accounts, devices and people, where compromises actually start, instead of on folklore.
Which kind of MFA should you choose?
CISA states that any form of multifactor authentication is better than none, including text messages and authenticator codes, because it raises the cost of attack. It also says phishing is consistently the most cost effective way for attackers to compromise systems, and that FIDO authentication is the widely available phishing resistant option, which can block a login attempt on an imposter site.
So the order is: first get MFA on everywhere, then move your most exposed accounts, such as email and finance, to FIDO.
A constructed example
A twelve person design studio has no IT staff. The owner appoints the office manager as Security Program Manager. In month one they enable MFA on email and the bank, list every laptop and phone that touches client files, turn on automatic updates, and set up an offsite backup that they test by restoring one folder. In month two the owner reads and signs a one page incident plan with phone numbers printed on paper, and the team runs a twenty minute tabletop: "what do we do if the owner's email is taken over on a Friday evening?" Nothing here costs much. All of it needs a person who owns it, and a date on the calendar when someone checks that it happened. Small companies tend to skip the checking step, and that is where good intentions quietly lapse.
How to check or apply this
- Name a Security Program Manager and set a monthly check in with the owner.
- Enable MFA on email, banking, cloud storage and admin accounts. Plan FIDO for the most exposed accounts.
- Make a list of devices and software in use. You cannot patch what you have not listed.
- Turn on automatic updates and track the percentage of systems fully patched.
- Back up important data, keep one copy offline, and test a restore.
- Write an incident response plan with roles and an address book that works if the network is down. Review it every quarter and after a near miss.
- Run a tabletop exercise at least once, with the owner in the room.
- If you write software or depend on open source packages, keep a list of dependencies and check it for known vulnerabilities.
Quick check
Do small businesses really need an incident response plan?
Yes. CISA's guidance has the CEO review and approve one, and says there will be no time to digest and refine it during an incident.
Is SMS-based MFA worth turning on?
Yes. CISA says any form of MFA is better than none, while noting that FIDO authentication is the phishing resistant option.
Sources
Last reviewed: 18 October 2026.
