Security starts with decisions, not products
A small business does not become defensible by buying one more security subscription. It becomes more defensible when the owner and office manager can answer six practical questions:
- What information and systems keep the business operating?
- Who is allowed to access them?
- Which safeguards are mandatory?
- How would the office notice a problem?
- Who makes decisions during an incident?
- How will the business restore operations?
These questions align with the six functions in the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. NIST describes the framework as voluntary and flexible, including a Small Business Quick-Start Guide for organizations with modest or no cybersecurity plans. The framework is not a certification checklist. It is a way to organize management decisions around business risk.
For a Central Florida professional office, manufacturer, contractor, clinic, nonprofit, or service company, the cornerstone is a short written record showing what matters, who owns each decision, and what evidence supports the answer.
1. Govern: decide what “good enough” means
Someone with authority must own the security program. That may be the business owner, managing partner, operations director, or office manager supported by an outside provider. The title matters less than the responsibility.
Write down:
- The business systems that cannot be unavailable for more than one business day.
- The information that would create legal, financial, contractual, or customer harm if exposed.
- Any requirements from healthcare, financial, government-contracting, insurance, or customer agreements.
- The person who can approve emergency technology changes or shut down an account.
- The schedule for reviewing security decisions.
The Federal Trade Commission advises businesses to document applicable legal, regulatory, and contractual requirements and to assess security risks involving suppliers and other third parties. That means a vendor contract, cyber-insurance application, or client security questionnaire may be part of the security record—not paperwork kept in a separate universe.
2. Identify: build a useful inventory
You do not need a perfect asset database on day one. Start with a working inventory that a manager can review.
Include:
- Business email and identity accounts.
- Laptops, desktops, mobile devices, servers, and network equipment.
- Cloud file storage, accounting, payroll, customer relationship, and practice-management systems.
- Payment systems and point-of-sale devices.
- Sensitive information, including customer, patient, employee, financial, or intellectual-property data.
- Vendors with administrative or remote access.
For each important system, record the business owner, technical administrator, backup method, recovery contact, and renewal date. If no one knows who controls a system, that uncertainty is itself a security issue.
3. Protect: establish a small-business baseline
The first protective measures should reduce common account, device, and data failures.
- Require multi-factor authentication, beginning with email, administrator accounts, remote access, financial systems, and cloud storage.
- Use unique, long passwords and a password manager rather than shared spreadsheets or reused passwords.
- Turn on automatic updates where practical and maintain supported operating systems and applications.
- Remove former employees and unnecessary vendor accounts promptly.
- Limit access to sensitive information according to job need.
- Separate guest Wi-Fi from business systems.
- Encrypt sensitive data in transit and at rest when supported by the platform.
- Maintain backups that are not continuously exposed to the same accounts or network affected by an attack.
CISA’s small-business materials identify phishing resistance, strong passwords, MFA, software updates, logging, backups, and encryption as core practices. The FTC likewise recommends MFA, updates, access controls, encryption, and regular backups.
The goal is not to claim that every risk has been eliminated. The goal is to make unsafe exceptions visible and time-limited.
4. Detect: make unusual activity reportable
A small office may not have a security operations center. It still needs a way to notice and escalate warning signs.
Define what employees should report immediately:
- An unexpected MFA prompt or password-reset message.
- A payment or bank-account change request.
- Missing files, unusual file extensions, or disabled security software.
- A lost device or suspected stolen credential.
- A vendor asking for unusual remote access.
- A message that appears to come from an executive but changes normal process.
If your cloud provider offers sign-in alerts, audit logs, forwarding rules, or administrator notifications, enable and review them. Ask your technology provider what is monitored, what is retained, and who receives alerts. “We have logs” is not the same as “someone will act when the logs show a problem.”
5. Respond: prepare the first conversation
An incident plan should fit on a few pages and be usable under pressure. Keep current contact information for:
- The internal decision-maker.
- The IT provider or managed service provider.
- The email, cloud, banking, and insurance contacts.
- Legal counsel or a breach-response contact, when appropriate.
- Local law enforcement and the FBI reporting route.
- Key customers, suppliers, and business-continuity partners.
State what employees must not do: do not delete evidence, negotiate with an attacker independently, forward suspicious messages widely, or restore systems before the response lead approves the step. CISA and FTC guidance both emphasize planning for incidents and maintaining the ability to keep operating after ransomware or other disruption.
6. Recover: test the business outcome
A backup is an input to recovery, not proof of recovery. Test whether the business can restore a representative file, recover an important account, contact the backup provider, and continue essential work if the primary system is unavailable.
Document:
- What was tested.
- When it was tested.
- Which data or service was restored.
- How long restoration took.
- What failed or required manual work.
- Who approved the next improvement.
Start with the systems that affect revenue, safety, compliance, customer commitments, and payroll. Recovery priorities should reflect business consequences, not simply whichever application is easiest to restore.
A 30-day cornerstone plan
During the next month, a Central Florida business can create a credible foundation by completing four meetings or work sessions:
- Week 1: approve the owner, scope, and six-function security record.
- Week 2: inventory accounts, devices, data, vendors, and recovery contacts.
- Week 3: verify MFA, former-user removal, updates, backups, and administrator access.
- Week 4: run a short incident-contact and restore test; record unresolved items.
The result should be a living management record, not a binder assembled once for appearance. Review it after staffing changes, major technology purchases, vendor changes, incidents, and at least on a regular operating schedule.
A defensible business is not one that promises perfect security. It is one that can explain its priorities, prove its basic safeguards, recognize warning signs, make decisions quickly, and restore the work customers rely on.