1. Protect the accounts that matter most with MFA

If someone steals an employee's email password, they may be able to reset other accounts, read invoices, or impersonate the business. Multi-factor authentication (MFA) adds a second requirement beyond a password. It is especially important for email, banking, payroll, remote access, and administrative accounts.

Where supported, prefer phishing-resistant methods such as passkeys or security keys. Authenticator apps are generally a better choice than no MFA, but not all MFA methods resist modern phishing equally. Review any legacy accounts or applications that bypass MFA, and keep recovery methods protected.

2. Stop reusing passwords

A reused password turns a breach at one website into a possible breach of your business systems. Give every employee their own account and use a reputable password manager to create and store unique credentials. Avoid shared administrator logins, and do not email passwords between staff members.

Long passphrases or generated passwords are easier to defend than short, predictable variations. Also change manufacturer-default credentials on routers, printers, cameras, and other network-connected devices. Document how the business will regain access if a staff member leaves or a password manager account becomes unavailable.

3. Keep computers, software, and network equipment updated

Windows and Microsoft 365 are not the entire technology environment. Browsers, PDF readers, accounting applications, firewalls, access points, and backup software also receive security updates. Unpatched systems may be exposed even if the antivirus program is running.

Maintain a basic inventory of devices, software, owners, and support status. Assign someone to review patch failures and end-of-support dates. Test high-impact changes when necessary, but do not treat “we will update it later” as an indefinite plan. Unsupported devices should be replaced or isolated under a documented risk decision.

4. Train staff to recognize suspicious requests

Many scams look like ordinary work: a vendor sends new bank details, a supervisor requests gift cards, or an employee receives a shared-file notification that leads to a fake sign-in page. Staff should have a simple way to verify unusual requests without fear of creating extra work.

For a change to payment instructions, call the vendor using a previously verified number rather than the one in the suspicious message. Teach employees to report unexpected MFA prompts, unusual login screens, and messages asking them to hurry or keep a request secret. A short reminder during onboarding and periodic refreshers are more useful than a policy nobody reads.

5. Back up business data and test recovery

Security controls lower risk but do not eliminate accidental deletion, hardware failures, ransomware, or operational mistakes. Keep recoverable backups of important data, including material stored in cloud applications where the provider's retention features may not match your recovery needs.

A backup must be protected from the same event that affects production. Use a separate location and appropriate access controls, and make sure someone can restore files and critical applications. A scheduled test is what distinguishes a recovery plan from a hopeful assumption.

Where to begin if everything needs attention

Start by identifying the administrator and financial accounts, enabling MFA, and confirming that each worker has a unique login. Next, inventory business computers and unsupported software, secure the firewall and Wi-Fi, and review your backup status. Then assign an owner for routine checks and incident reporting.

Write down who to call if a business email account is compromised or the network goes down. Keep a copy of that contact plan outside the affected systems. You can build toward a more complete security program, but these five measures address real gaps many small businesses can act on immediately.