Cybersecurity Best Practices: A Baseline for Every Business

Start with the basics

Most incidents at small and mid-size businesses come from a short list of causes: stolen passwords, phishing, unpatched systems and weak backups. Fixing those first does more than buying advanced tools.

1. Protect accounts

• Multi-factor authentication on email, remote access and administrator accounts
• Unique accounts for every person; no shared logins
• Password manager for staff
• Remove access immediately when someone leaves

2. Secure email

• Spam and phishing filtering
• Warning banners on external email
• Block auto-forwarding to outside addresses
• A simple way for staff to report suspicious messages

3. Patch and protect devices

• Automatic operating system and application updates
• Managed endpoint protection with central alerts
• Disk encryption on laptops
• Retire unsupported software and hardware

4. Back up and test

Keep at least one copy offsite and protected from changes. Test restores on a schedule. Write down how long recovery should take and check that the backup design can meet it.

5. Train your people

Short, regular training and phishing simulations change behavior better than one annual session. Make it easy and safe for staff to report mistakes quickly.

6. Prepare for an incident

• Written response plan with names and phone numbers
• Contact details for your IT provider, insurer and legal counsel
• Logging that lets you see what happened
• A tabletop exercise once a year

7. Know your compliance obligations

Contracts and regulations may require specific controls. Defense suppliers handling CUI must meet NIST 800-171 under CMMC. See our CMMC readiness site for details.

Quad-B Systems provides this guidance for general information. Your needs depend on your environment, contracts and regulations.