{"id":197370,"date":"2026-10-08T10:38:46","date_gmt":"2026-10-08T15:38:46","guid":{"rendered":"https:\/\/cmitsolutions.com\/wilmington-nc-1168\/?p=197370"},"modified":"2026-10-09T15:55:57","modified_gmt":"2026-10-09T20:55:57","slug":"he-asked-for-the-simplest-ten-here-they-are-plus-one","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/wilmington-nc-1168\/blog\/he-asked-for-the-simplest-ten-here-they-are-plus-one\/","title":{"rendered":"He Asked for the Simplest Ten. Here They Are + 1."},"content":{"rendered":"

A referral partner in my networking group recently asked me for the ten simplest, lowest-cost steps a business can take to improve its security. These are my small business cybersecurity tips for exactly that request. It is a better question than it sounds, because most security advice begins with a product. These ten begin with settings and habits, and most of them cost nothing at all.<\/p>\n

October is Cybersecurity Awareness Month, so this seems like the right moment to answer him properly. Here they are, in the order I would work through them.<\/p>\n

Small Business Cybersecurity Tips for Accounts and Passwords<\/h2>\n

First, turn on multi-factor authentication everywhere it is offered, starting with email, banking, and payroll. Email comes first because it is the master key; whoever controls your inbox can reset the password on nearly every other account you have. Where you have a choice, use an authenticator app or a passkey rather than text message codes. Text codes are far better than nothing, but they can be intercepted or redirected, and an app or passkey closes most of that gap. Microsoft reports that MFA blocks more than 99 percent of identity-based attacks, which makes it the best return on ten minutes you will find anywhere on this list.<\/p>\n

Second, if your business runs on Microsoft 365, confirm that Security Defaults are turned on. Microsoft provides them free to every organization, and they have been on by default for tenants created since October 2019. They require everyone to register for MFA, require administrators to use it every time they sign in, and block the older sign-in methods that cannot do MFA at all, which is precisely why attackers favor them. Older tenants, or tenants someone adjusted years ago, may have them switched off. If your IT provider uses Conditional Access policies instead, that is a more granular version of the same protection, and Security Defaults will be off for a good reason. Either way, ask which one you have.<\/p>\n

Third, give everyone a password manager and expect them to use it. The goal is a long, unique password for every account, and nobody can remember forty of those. A business password manager also lets you share a login without emailing it and take it back when someone leaves. Reused passwords are how a breach at some unrelated shopping site turns into a breach of your company email.<\/p>\n

Protecting Devices and Data<\/h2>\n

Fourth, let updates install automatically, and retire the devices that no longer receive them. Attackers rarely need a novel technique; they exploit known flaws in software nobody patched. A Windows 10 computer without extended security updates falls into that category now. A machine that cannot run a supported operating system is not saving you money. It is a liability with a keyboard.<\/p>\n

Fifth, keep one separate, tested backup of the data you cannot afford to lose. Microsoft 365 and Google Workspace keep your data available, but redundancy is not the same as backup; when something is deleted or encrypted, the deletion or the encryption replicates right along with everything else. A real backup lives somewhere separate, and someone restores a file from it now and then. Until somebody does, you do not actually know that it works.<\/p>\n

Cybersecurity Tips for People and Process<\/h2>\n

Sixth, verify every change to payment or banking details by phone, using a number you already have on file rather than one supplied in the email. This costs nothing and stops one of the most expensive scams small businesses face: the convincing invoice or vendor message asking you to send money somewhere new<\/a>. The fraudster may control the email thread. He does not control the phone number in your records.<\/p>\n

Seventh, stop using administrator accounts for daily work. If the account you use to read email and browse the web can also install software and change system settings, then so can anything that tricks you into clicking. Keep a separate administrator login for the occasions that genuinely require it, and use a standard account the rest of the time.<\/p>\n

Eighth, remove access the same day someone leaves. That means email, cloud applications, shared passwords, remote access, and the alarm code. A written checklist turns departures from a scramble into a routine, and it protects the departing employee as much as it protects you.<\/p>\n

Ninth, put guests on their own Wi-Fi network and change the default passwords on your router and firewall. A customer’s phone, a vendor’s laptop, and your accounting computer have no business sharing a network. Default passwords for network equipment are printed in manuals anyone can download.<\/p>\n

Have a Plan for When Something Goes Wrong<\/h2>\n

Tenth, write a one-page plan that says whom to call when something goes wrong, and tell your staff plainly that nobody will be blamed for reporting a mistake. The first hour of an incident matters more than any other, and it is usually lost to embarrassment. An employee who clicked a bad link and says so within five minutes has handed you a problem you can contain. An employee who stays quiet for a week has handed you a much larger one.<\/p>\n

None of these small business cybersecurity tips requires a new product or a large budget. CISA’s own short list for businesses<\/a> has four items: phishing awareness, strong passwords, MFA, and software updates. Three of those appear on my list outright, and the fourth, phishing awareness, works far better when people feel safe admitting what they clicked.<\/p>\n

The Plus One Worth Paying For<\/h2>\n

Now the plus one. It is the only item here that costs real money, and it is worth every dime: identity threat detection and response, usually shortened to ITDR, watching your business email. ITDR connects to your Microsoft 365 or Google Workspace account at the administrator level and watches how every mailbox is actually used: where people sign in from, which sessions look wrong, and which inbox rules suddenly start forwarding mail to a stranger. When a login looks stolen, the account can be shut down within minutes. Back in April I wrote about an attorney who was back at work fifteen minutes after a compromised password, because ITDR caught it first.<\/p>\n

ITDR will not prevent the attack; the first ten steps do most of the preventing. What it does is limit how far an intruder gets and tell you exactly what happened: which account, when, from where, and what the attacker touched. That second part matters more than most owners expect, because after a compromise the hardest question is rarely how to get back in. It is what they saw.<\/p>\n

There is one catch. ITDR needs a business email platform to watch. A free Gmail or Outlook.com account has no administrator console for it to connect to, so there is nothing to monitor. If your business still runs on free email, that is one more reason to move it onto your own domain.<\/p>\n

My referral partner asked for the simplest ten. I gave him eleven, because the eleventh is the one I would argue for hardest. Simple is not the same as done, so pick one this week and start there.<\/p>\n

Until next time, keep IT simple.<\/p>\n

Dave<\/p>\n

CMIT Solutions of Wilmington<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

\"A<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

A referral partner in my networking group recently asked me for the…<\/p>\n","protected":false},"author":209,"featured_media":197372,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,1,16],"tags":[],"class_list":["post-197370","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-local-it","category-newsletter"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t