Manage risk. Small business owners should start by asking what information is most important to the business and what’s essential for them to protect. For example, if a marketing booklet gets leaked it’s probably not as sensitive as if a customer list was exposed.

Train the staff. Run a lunchtime seminar on how to identify phishing attacks and how to notify suspicious email and report it to the owner. It’s also important for the staff to be aware of the company’s policies on using Facebook, YouTube videos or general Internet browsing time. If there are no policies, then make your wishes known to the staff.   

Stay up to date.  Keep in mind there are small businesses with close to 100 employees and those with under 10. For the companies with under 10 employees, they may have a tech person who comes to set up the network, but they don’t always have that person handle software updates and patches. We understand there’s a lot going on at your company and you are focused on sales, but don’t let updates and patches sift through the cracks. Automate as much as possible, but try to do the updates when they come out.  

Run backups routinely. So many small businesses don’t do this and with ransomware as much as a threat as it is today, running offsite backups has become more important than ever. Decide if backups need to be run once a day or once a week, but once a month won’t keep your company safe.   

Investigate cyber insurance. Cyber insurance may or may not be worth it to your company. However, it makes sense to talk to some insurance brokers and see where you stand. Whatever you do, don’t call about cyber insurance without having your security program in place. The rates you pay and how much cyber insurance your company qualifies for will be based on your overall security posture. A ratings system has been evolving and has not been standardized yet, and be prepared to do some homework before asking a broker about cyber insurance.

Seek out a professional IT company. Even larger small businesses tend to have an IT person or outsourced contractor who comes in and sets up and manages the network. Use business contacts or your trade association to find out technology companies with experience running network security, preferably in your industry if possible. These companies can set up individual password accounts, secure the routers, install firewalls and web filters and explain how the system runs to the owner or the owner’s designated in-house tech person. Too many companies try to go it alone and then complain about spending money on a professional IT company. Don’t be that company. One breach of a prized customer list or sales results that get into the wrong hands and it could cost you your business. Working with professional IT people is well worth the expense, especially in this threat landscape.