Start with the business, not the tool list
For a 5–100-person business, the first job is to identify what must keep working: customer communication, payments, access to critical files and the ability to restore after a mistake or attack. Write down who owns each. A security tool without an operator or a recovery test is an expense, not a completed control.
NIST SP 1300 is the final Cybersecurity Framework 2.0 quick-start guide for small businesses. Use it to organize risk work, not to claim “NIST compliance.” CISA's SMB resources and FTC's small-business guidance offer additional practical steps. Regulations and customer contracts may require more; review those separately with the appropriate adviser.
The first five controls
- Account access: require MFA for administrators, finance staff and all cloud accounts where available. Remove former employees and review privileged access monthly. Test account recovery before an emergency.
- Payment verification: confirm bank-detail changes and unusual transfer requests using a known number from existing records, with a second approver for significant transactions. A convincing voice or message is not proof of authority.
- Device updates and protection: list every company and regularly used personal device, including servers. Apply supported updates through an owned process, track exceptions and confirm that endpoint protection is active.
- Recoverable data: identify systems that cannot be recreated, maintain a separate recovery copy and restore a representative file or system. A cloud-sync folder alone is not a complete backup.
- Incident response: tell staff where to report suspicious activity and name the person who can disable an account, stop a payment and call an outside provider. Practice that first-hour decision chain.
Unknown status is a task to verify, not a reason to mark the control done. The free assessment distinguishes missing, unknown and inapplicable answers, then gives priority actions.
A 90-day implementation plan
| Time | Owner's work | Proof of completion |
|---|---|---|
| Days 1–30 | Inventory critical accounts, devices, payment approvers and data; enable MFA and callback verification | Admin and finance accounts show MFA; a test payment change gets independent approval |
| Days 31–60 | Establish patch and backup cadence; remove stale access; document one incident contact | Device list matches managed devices; a representative restore works; former staff cannot sign in |
| Days 61–90 | Exercise incident response, review unresolved exceptions and decide whether to buy a service | Exercise produces assigned fixes; any purchase request names the gap, owner, cost and test |
Give each action one owner and a date. A five-person firm may have the owner and the external IT provider share tasks; a 100-person firm may need a formal ticket process. Neither should skip verification.
Spend only after checking what you own
Review your Microsoft 365 or Google Workspace edition, backup contract, firewall and endpoint licenses. For example, Microsoft Defender for Business is included in Microsoft 365 Business Premium. Check whether it is configured and meets your needs before buying another endpoint product. If no one can operate a control internally, compare managed support against self-operated software. Include setup, support and renewal in the quote.
The budget guide provides a purchase gate, and the small-business backup guide helps define recovery. Once those basics are demonstrably working, evaluate the next specific gap: email protection, vulnerability management, remote access or monitoring. Do not use a generic “best tools” list as the implementation order.
This guide is based on official sources checked September 25, 2026, not a test of your environment or a guarantee against incidents. Read our methodology and affiliate disclosure. Product links are illustrative; no commission is assumed without a confirmed partner relationship.
Get your next three actions
Complete the free, no-signup assessment and start with the controls that matter for your business.
Start the free assessment