{"id":842,"date":"2026-04-27T10:20:40","date_gmt":"2026-04-27T15:20:40","guid":{"rendered":"https:\/\/cmitsolutions.com\/des-moines-ia-1210\/?p=842"},"modified":"2026-04-28T12:07:45","modified_gmt":"2026-04-28T17:07:45","slug":"small-business-cybersecurity-tips-compliance","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/des-moines-ia-1210\/blog\/small-business-cybersecurity-tips-compliance\/","title":{"rendered":"Why Compliance is Mission-Critical for Small Businesses"},"content":{"rendered":"
\n
\nRead Blog Post (Click to Expand\/Collapse)<\/summary>\n
\n

Key Takeaways<\/h3>\n
    \n
  • Compliance is not paperwork<\/strong>\u2014it\u2019s proof that your business is protected.<\/li>\n
  • Small businesses are prime targets<\/strong> for automated cyberattacks.<\/li>\n
  • Basic security controls can prevent the majority of incidents.<\/li>\n
  • Documentation is critical for protection and accountability.<\/li>\n
  • A proactive approach is far more effective than reacting after an attack.<\/li>\n
  • Partnering with experts can significantly reduce overall risk.<\/li>\n<\/ul>\n
    \n

    From Military Operations to Cybersecurity Advocacy<\/h3>\n

    Edgar Ortiz\u2019s journey into cybersecurity is rooted in his background in military intelligence and aviation, where operational discipline was critical. After transitioning to civilian life and starting his own business, a ransomware attack<\/strong> wiped out everything he had built.<\/p>\n

    Rather than stepping away, he used that experience as fuel to help other small and medium-sized businesses avoid the same fate. Today, his mission is centered on protection, resilience, and education.<\/p>\n

    What Compliance Really Means<\/h3>\n

    One of the biggest misconceptions is that compliance is just an annual checkbox exercise. In reality, compliance is about proving<\/strong> that your business is actively protecting sensitive data.<\/p>\n

    In practical terms, this includes:<\/strong><\/p>\n

      \n
    • Having a documented password policy.<\/li>\n
    • Regularly backing up and testing<\/strong> data.<\/li>\n
    • Monitoring system access.<\/li>\n
    • Maintaining clear security documentation.<\/li>\n<\/ul>\n

      At its core, compliance is simply good operational hygiene backed by documentation\u2014a safety net when things go wrong.<\/p>\n

      The Dangerous Myth: \u201cWe\u2019re Too Small to Be Targeted\u201d<\/h3>\n

      Many owners assume they aren\u2019t attractive targets. Unfortunately, the opposite is true. Hackers often prefer small businesses because security measures are typically weaker and automated attacks scan for easy entry points<\/strong>. With a cyberattack occurring every 39 seconds, no business is too small to be at risk.<\/p>\n

      Lessons from a Ransomware Disaster<\/h3>\n

      Edgar\u2019s experience highlights a critical truth: most incidents stem from missing basic safeguards<\/strong>. When his attack occurred, the gaps were clear: no multi-factor authentication (MFA), untested backups, and no incident response plan. These foundational controls exist to prevent disasters or, at the very least, minimize the damage.<\/p>\n

      How Managed IT Services Strengthen Compliance<\/h3>\n

      Working with a managed IT provider can dramatically improve your security posture. The process begins with a vulnerability assessment<\/strong>, followed by implementing essential controls:<\/p>\n

        \n
      • Multi-factor authentication (MFA)<\/strong><\/li>\n
      • Zero trust access controls<\/strong><\/li>\n
      • Regular patching and updates<\/strong><\/li>\n
      • Endpoint protection and monitoring<\/strong><\/li>\n<\/ul>\n

        Building a Strong Foundation<\/h3>\n

        The first step in any compliance journey is understanding your current environment. This includes evaluating your infrastructure, understanding personnel workflows, and identifying risks. A thorough assessment provides the roadmap for implementing effective security strategies.<\/p>\n

        \n

        Frequently Asked Questions<\/h3>\n

        1. What is compliance in simple terms?<\/strong>
        \nCompliance means having documented processes and safeguards in place to protect sensitive business and customer data.<\/p>\n

        2. Why are small businesses targeted by hackers?<\/strong>
        \nBecause they often lack strong security measures, making them easier and more profitable targets for automated tools.<\/p>\n

        3. What are the most important first steps?<\/strong>
        \nStart with MFA, secure backups, access control, and documented policies.<\/p>\n

        4. Is compliance only for large companies?<\/strong>
        \nNo. Any business handling sensitive data\u2014regardless of size\u2014needs to follow compliance best practices.<\/p>\n

        5. What happens if a business is non-compliant during a breach?<\/strong>
        \nIt can lead to legal consequences, heavy financial loss, and permanent reputational damage. Ignorance is not a legal defense.<\/p>\n

        6. How can a managed IT provider help?<\/strong>
        \nThey assess your systems, implement controls, monitor threats, and ensure your business stays compliant as regulations evolve.<\/p>\n<\/div>\n

        \n

        From Military Operations to Cybersecurity Advocacy<\/h3>\n

        Edgar Ortiz\u2019s journey into cybersecurity is rooted in his background in military intelligence and aviation. After transitioning to civilian life, a ransomware attack<\/strong> wiped out everything he had built. Today, his mission is centered on protection, resilience, and education.<\/p>\n<\/details>\n<\/div>\n

        \nView Full Transcript (Click to Expand\/Collapse)<\/summary>\n
        \n
        \n

        Mike Downer:<\/strong> Hi, I’m Mike Downer, and I am your host today. I’m here with Edgar. Edgar Ortiz is the owner of CMIT Solutions of Des Moines. So Edgar, tell us a little bit about yourself, your background, and how you got into all this.<\/p>\n

        Edgar Ortiz:<\/strong> Yes, I’m Edgar Ortiz with CMIT Solutions of Des Moines. We are a managed IT provider and a cybersecurity and AI implementation company. We help small to medium-sized businesses with IT, cybersecurity, and now AI implementation.<\/p>\n

        How I came about all this was through operations and intelligence work in the military, and also aviation\u2014pretty much working with systems and operational backgrounds for intelligence and aviation. I did a lot on the IT side in the military. Then when I got out, I worked for the government for a little bit in operations, and then I opened my own small business.<\/p>\n

        Unfortunately, we did have an attack where we pretty much lost everything. Like many small businesses, we don\u2019t think about that. We think because we\u2019re small, we\u2019re not going to get hacked, or hackers are not looking for us. Boy, I was wrong about that. That is the reason we are here now\u2014trying to help small and medium-sized businesses not go through what we went through.<\/p>\n

        Mike Downer:<\/strong> So it sounds like you’re a pretty resilient guy. Instead of just folding it up and going to work for somebody else, you decided to take charge of it and help other people not have to suffer what you went through.<\/p>\n

        Edgar Ortiz:<\/strong> Yeah, definitely. Just trying to help other small and medium-sized business owners understand what is out there right now and the threats we are all facing\u2014especially now with AI increasing cyberattacks tenfold.<\/p>\n

        We\u2019re not only here to help you connect your computer to the internet, connect your computer to your printer, or fix a blue screen. We\u2019re here to protect your business and give you peace of mind so you can do what you do best\u2014run your business and gain new clients in whatever sector you\u2019re in.<\/p>\n

        That\u2019s the reason we are here. We have a mission. The same mission we had in the military is how we treat our operations now. We are here to help people be in the best spot and not worry about cyberattacks.<\/p>\n

        The problem is we sometimes don\u2019t worry about it because we don\u2019t feel it or see it. We think, \u201cI only have two computers, three computers, maybe five people in my office.\u201d But yes, it can happen to you\u2014and it happens every thirty-nine seconds in this country.<\/p>\n

        Mike Downer:<\/strong> Wow, that\u2019s a lot\u2014every thirty-nine seconds. Now that we know a little about your background and what you guys do, I think we should get started.<\/p>\n

        What I wanted to talk to you about today was why compliance is now mission-critical for a small business. Edgar, when you talk about compliance today, what does that actually mean for a small business in practical terms?<\/p>\n

        Edgar Ortiz:<\/strong> Definitely. Compliance isn\u2019t a stack of paper or a checkbox you hand to your accountant once a year. For small businesses, compliance in practical terms means: do you have documented proof that you are protecting your customer data, your employees\u2019 data, and your information? As a business owner, do you know who is in your system and who is using it?<\/p>\n

        That means things like:<\/p>\n

        Do you have a written password policy?<\/p>\n

        Are you backing up your data and testing those backups?<\/p>\n

        Do you know who is accessing and using your network?<\/p>\n

        Compliance is really just good operational hygiene with documentation behind it. The documentation is what protects you when something goes wrong\u2014and believe me, something eventually will. That\u2019s what compliance is about: protecting you from something coming in the future.<\/p>\n

        Mike Downer:<\/strong> In your experience, what\u2019s the biggest misconception business owners have about compliance\u2014especially being too small to matter?<\/p>\n

        Edgar Ortiz:<\/strong> That\u2019s a great question. The number one thing I hear is, \u201cI\u2019m too small. Nobody is coming after me.\u201d That is exactly backwards. Hackers love small businesses because they assume you are not protected.<\/p>\n

        Automation and AI-driven attacks don\u2019t discriminate by revenue size. They don\u2019t care how many people you have. They scan millions of addresses looking for an easy door. If you process credit cards, have health information, or handle sensitive data, you need compliance.<\/p>\n

        Ignorance of requirements is not going to defend you when a breach happens. Telling a judge, \u201cI didn\u2019t know, I\u2019m too small,\u201d is not going to fly. Ignorance is not a defense.<\/p>\n

        Mike Downer:<\/strong> Kind of like speeding. If you’re going 55 in a 35 and say you didn\u2019t know, you still get a ticket.<\/p>\n

        Edgar Ortiz:<\/strong> Exactly.<\/p>\n

        Mike Downer:<\/strong> You personally lived through a ransomware disaster. How did compliance gaps contribute to that in your case?<\/p>\n

        Edgar Ortiz:<\/strong> That experience was a turning point for me professionally and personally. The gaps weren\u2019t technical mysteries\u2014they were basic controls that weren\u2019t implemented or documented.<\/p>\n

        We didn\u2019t have:<\/p>\n

        Proper multi-factor authentication<\/p>\n

        Tested backups<\/p>\n

        A clear incident response plan<\/p>\n

        When things went sideways, people panicked instead of executing. Compliance frameworks exist because smart people\u2014regulators, insurers, and security experts\u2014identified what prevents disaster or limits damage.<\/p>\n

        When you skip those steps, you\u2019re not just non-compliant\u2014you\u2019re exposed. I lived that lesson the worst possible way. I lost everything. That\u2019s why I do what I do now.<\/p>\n

        Mike Downer:<\/strong> Since you\u2019ve lived it and started from ground zero, how does having a managed services partner like CMIT change the compliance equation?<\/p>\n

        Edgar Ortiz:<\/strong> When we onboard a new client, we start with the unglamorous fundamentals where most risk lives:<\/p>\n

        Multi-factor authentication everywhere<\/p>\n

        Zero trust access controls<\/p>\n

        Patch management and updates<\/p>\n

        Backup integrity and testing<\/p>\n

        Endpoint protection with real monitoring<\/p>\n

        Documented security policies<\/p>\n

        Those basics alone put small businesses ahead of most peers. Then everything builds from that foundation. You can build with confidence.<\/p>\n

        Mike Downer:<\/strong> If a business owner reaches out, what are the first compliance controls you put in place?<\/p>\n

        Edgar Ortiz:<\/strong> First, we complete an assessment. We ask a lot of questions and deploy an agent for about 24 hours. That generates a report showing what we discover in your system.<\/p>\n

        Then we:<\/p>\n

        Understand your business<\/p>\n

        Walk through your environment<\/p>\n

        Learn your people and processes<\/p>\n

        From there, we handle the IT and security. It starts with a thorough assessment.<\/p>\n

        Mike Downer:<\/strong> To sum it up, no business is too small. In fact, smaller businesses may be more susceptible.<\/p>\n

        Edgar Ortiz:<\/strong> Exactly.<\/p>\n

        Mike Downer:<\/strong> Is there anything you’d like to conclude with before we sign off?<\/p>\n

        Edgar Ortiz:<\/strong> Thank you to everyone watching. This is new for us, and we\u2019ll be here a couple times a month to talk directly with you. We\u2019re here in Des Moines and also Overland Park, Kansas. We cover the Midwest.<\/p>\n

        We\u2019re different not because we have better tools, but because we went through it. We know what you’re going through as a business owner, and we\u2019re here to protect you, your organization, and your family.<\/p>\n

        Mike Downer:<\/strong> Edgar, thank you for your time today. Next week we\u2019ll get together and learn more. See you next week. Thank you very much.<\/p>\n

        Edgar Ortiz:<\/strong> Thank you.<\/p>\n<\/div>\n<\/div>\n<\/details>\n","protected":false},"excerpt":{"rendered":"

        Read Blog Post (Click to Expand\/Collapse) Key Takeaways Compliance is not paperwork\u2014it\u2019s…<\/p>\n","protected":false},"author":1033,"featured_media":840,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-842","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-local-it"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t