Five inexpensive things you can do today to make your business much harder to hack

By Michael Obraitis, Managing Partner, and Michael Dale, CEO · Published August 20, 2026 · Last reviewed August 2026 · ADAM Pulse Knowledge Base · Privacy and Security Series

Short answer

The five cheapest improvements available to most businesses are:

1. Turn on multi-factor authentication, starting with email, banking, your identity provider and every administrator account.
2. Give every person their own account, stop sharing logins, and take administrator rights off ordinary user machines.
3. Turn on automatic updates for everything — including the firewall, the access points, the printer and the website.
4. Back up what matters, keep a copy offline, and test a real restore.
5. Secure the company's public identity — domain registrar, DNS, website, social accounts and email sending domain.

None of them requires buying a security product. All of them are things you already own, configured properly.

<div class="callout"><span class="callout-label">Before you buy anything</span><p>Cybersecurity does not have to start with an expensive product. For most small and midsized businesses the highest-value improvements are configuration changes to technology already in the building. None of these eliminates risk. Together they remove several of the openings attackers rely on most.</p></div>

One warning before the detail. Some very widely repeated advice in this area is now formally contradicted by NIST's own current guidance — in particular "change your password every 90 days" and "require a mix of letters, numbers and symbols." Both are now things NIST says you SHALL NOT do. If your policy still requires them, that section is worth reading carefully.

1. Turn on multi-factor authentication

Cost: usually nothing. It is already included in services you pay for.

What is the single cheapest cybersecurity improvement?

Enabling MFA on the accounts that matter. NIST puts it plainly in its small business quick-start guide:

Enabling multi-factor authentication (MFA) is one of the fastest, cheapest ways you can protect your data. Start with accounts that can access the most sensitive information.

Which accounts should get MFA first?

Do not try to do everything at once. NIST's own priority list for a small business is:

• Banking accounts
• Accounting and tax accounts
• Merchant accounts
• Google, Microsoft and/or Apple ID accounts
• Email accounts
• Password managers
• Website accounts

CISA adds the one people forget: every system administrator account. Its guidance for small businesses is blunt about how to do it — "Ensure MFA is mandated using technical controls, not faith." A policy that asks people to turn MFA on is not a control. A setting that requires it is.

Is SMS-based MFA good enough?

This deserves a careful answer, because both extreme positions are wrong.

SMS codes are far better than no MFA. Do not let anyone talk you out of enabling MFA because they read that SMS is weak.

But SMS is officially the weakest tier, and you should plan to move off it. CISA's phishing-resistant MFA fact sheet describes SMS and voice one-time passcodes as "Vulnerable to phishing, SS7, and SIM swap attacks" and says this form "should only be used as a last resort MFA option." NIST's current authentication guidance goes further and classifies out-of-band authentication over the phone network as the guidelines' single restricted authenticator.

The better options, in order:

• Passkeys or a FIDO2 security key. CISA calls phishing-resistant MFA "the gold standard" and says the only widely available form is FIDO/WebAuthn.
• An authenticator app with number matching, which CISA recommends if you cannot yet get to FIDO, because it blocks push-bombing.
• SMS, as a stopgap on accounts that support nothing better.

Do not forget the domain registrar

Businesses think hard about Microsoft 365 and forget entirely about the account that controls their domain name and DNS. That account can redirect your website and your email. It deserves the same protection as your email tenant, and it frequently has none.

2. Give everyone their own account

Cost: nothing to very little.

Should employees share passwords?

No — and the argument that lands with business owners is not a security argument, it is an accountability one.

An office@company.com login known by eight people cannot tell you who did anything. Audit logs become useless, offboarding becomes impossible, and one departure means changing a password that eight people need.

Should every employee have their own account?

Yes, wherever the platform allows it. Then:

• Use a password manager.
• Require unique passwords for each service.
• Remove old accounts promptly.
• Replace default manufacturer passwords.
• Limit who holds administrator rights.
• Review periodically who actually needs access.

What does current password guidance actually say?

This is the part most policies get wrong, and it changed formally in 2025.

NIST's authentication guidance was revised and finalised on 31 July 2025. The previous version was withdrawn on 1 August 2025. The current requirements include:

• A minimum of 15 characters for a password used on its own. Eight is only acceptable when the password is one factor of MFA.
• Support for at least 64 characters, so passphrases work.
• "Verifiers and CSPs SHALL NOT impose other composition rules" — no forced mixtures of character types.
• "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically." A change is forced only where there is evidence of compromise.
• No security questions. NIST says verifiers SHALL NOT prompt for knowledge-based authentication such as your first pet's name.
• New passwords should be checked against a blocklist of known-compromised passwords.

Those are requirement-level statements, not preferences. If your written policy still mandates 90-day rotation and a symbol, it is now contrary to the standard it probably cites.

The reasoning is straightforward: forced rotation and composition rules push people toward predictable transformations. Password1 becomes Password2.

Should employees be local administrators on their computers?

Generally no. CISA's guidance for small businesses says it in four words: "Remove administrator privileges from user laptops."

Its performance goals go further on separation of duties: "No user accounts always have administrator or super-user privileges. Administrators maintain separate user accounts for all actions and activities not associated with the administrator role."

In practice that means an administrator has two accounts — one for administering, one for reading email.

What should happen when someone leaves?

CISA's benchmark is stricter than most businesses realise. Its performance goal requires a defined, enforced process applied to all departing employees by the day of their departure, revoking physical access and disabling all user accounts and access to organisational resources.

Not "within a week." Not "when IT gets to it." The day they leave.

A written offboarding checklist should at minimum cover: email, VPN, Microsoft 365 or Google Workspace, CRM, Zoom or your phone system, firewall administration, the password manager, social accounts, the website, cloud storage and financial applications.

3. Turn on automatic updates for everything

Cost: usually nothing.

What devices does a small business need to keep patched?

Anything connected to the network or the internet. People hear "software updates" and think Windows. The real list is longer:

Laptops, phones, browsers, Microsoft 365 or Google Workspace applications, the firewall, wireless access points, the router, VPN appliances, the website CMS and its plugins, network-attached storage, cameras, and printers.

Your five-year-old network printer, the forgotten access point above the ceiling tile, and the WordPress plugin nobody has touched since installation are all still software, and all still reachable.

How urgent is patching, really?

CISA's small business guidance frames it in terms of what a vulnerability gives away — access to files or accounts — and recommends installing updates promptly. The practical version for a small business: turn automatic updates on wherever the platform supports it, and put a recurring calendar reminder against the handful of devices that cannot update themselves.

4. Back up the business, and test the backup

Cost: usually modest against the value of the data.

If everything is in Microsoft 365 or Google Workspace, do we still need backups?

This is the question worth teaching people to answer for themselves rather than giving a flat yes or no. Separate five different things:

• Availability — the provider keeps the service running.
• Retention — how long deleted items are kept before they are gone.
• Versioning — whether you can go back to an earlier version of a file.
• Recycle bin recovery — a short window, usually measured in days.
• Independent backup — a copy the provider's own systems cannot reach.

Cloud storage gives you the first four to varying degrees. Whether you need the fifth depends on your recovery requirements — and on the scenario where the thing you are recovering from is an account compromise or a malicious deletion inside the tenant.

What should we actually back up?

Customer records, accounting data, contracts, CRM data, the Microsoft 365 or Google Workspace estate, the website, configuration files, firewall and network device configurations, employee files, and databases.

That last-but-one is the one people miss. Firewall and switch configurations are rarely backed up and are painful to rebuild from memory at two in the morning.

What does the guidance say about how to hold backups?

The joint federal ransomware guidance is specific:

Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.

And on why offline matters: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid."

On immutable cloud storage, the same guidance is more cautious than most vendors are: use it "with caution as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost."

Note that the "3-2-1 rule", widely attributed to CISA, does not appear in that guidance. The actual requirement is offline, encrypted, stored separately from the source systems, and tested.

How often should backups be tested?

CISA's performance goal sets a floor of at least once a year for both backup and restore testing. Treat that as a floor rather than a target. The useful question is not "do we have backups" but:

• Where is it backed up?
• Who can delete the backup?
• How long is it retained?
• Could ransomware reach it?
• When did we last complete a successful restore test?

If nobody can answer the last one, you do not know whether you have backups. You know you have backup jobs.

5. Secure the company's public identity

Cost: mostly nothing.

This is the one that differentiates a real answer from a generic listicle. Cybersecurity is not confined to the office network.

What counts as the company's digital identity?

• Domain registrar
• DNS
• Website and hosting
• Microsoft 365 or Google Workspace
• Social accounts
• Google Business Profile
• LinkedIn
• Facebook and Instagram
• Payment accounts
• The email sending domain and its authentication records

These deserve the same discipline as the internal network: MFA enabled, ownership documented, former employees removed, administrators limited, website software patched, DNS reviewed, domain expiry monitored, email authentication configured, and a clear answer to who controls each one.

The question to ask in the next management meeting

If the answer is no, that is not only a security problem. It is a business continuity problem, and it is one of the most common single points of failure in a small business.

The same question applies to the person who set up the social accounts, and to whoever registered the domain in their own name a decade ago.

The fifteen-minute business cybersecurity check

Answerable without any tooling. If you cannot answer one of these, that is where to start.

• Can you name every administrator across your systems?
• Does every administrator use MFA?
• Could you restore yesterday's important files?
• Are operating systems and network devices current?
• Do you control your domain registrar account?
• Could you disable a terminated employee's access today, not next week?
• Do you know who has access to your social accounts?
• Do you know when your firewall was last updated?
• Does anyone still share a login?
• Is there a written offboarding checklist, and was it used the last time someone left?

Where this guidance comes from

Two things worth knowing about the source material, because the landscape moved recently.

NIST's flagship small-business document is now SP 1300, the Cybersecurity Framework 2.0 Small Business Quick-Start Guide, published February 2024. The older NISTIR 7621 is still published but dates from 2016 and should not be presented as current best practice. NIST also has a 2026 draft aimed specifically at owner-only firms.

CISA's current front door for small business is Secure Our World, with its "Secure Your Business" page, and a deeper technical companion in Cyber Guidance for Small Businesses. The Cyber Essentials material that still circulates dates from 2019.

Frequently asked questions

Related articles

• Stop making one Google account the master key to your business — the identity concentration problem in detail.
• AI security checklist for businesses: 40 controls — the same MFA and identity hygiene, applied to approved AI tools and agents.
• What is Shadow AI and how do you find it? — unsanctioned AI is now part of the same small-business attack surface.
• What monitoring evidence does a CMMC Level 2 assessment ask for? — where these same controls have to be evidenced rather than merely done.
• Firewall monitoring: what to watch — making the network side visible.
• What does Incognito mode actually hide? — what your organisation can and cannot see, and why the policy should say so.

References

NIST and CISA only, and current editions. Where this article contradicts widely repeated advice — password rotation in particular — the reference is the document that supersedes it.

1. NIST SP 1300 — Cybersecurity Framework 2.0 Small Business Quick-Start Guide— February 2024, NIST's current flagship small business publication. Source for the MFA priority list and the backup and default-password recommendations.
2. NIST — Small Business Cybersecurity Corner— the hub, including quick-start guides and guidance by sector and topic.
3. NIST SP 800-63B-4 — Digital Identity Guidelines: Authentication and Authenticator Management— finalised 31 July 2025. Source for the 15-character minimum, the prohibition on composition rules, and the prohibition on periodic password change. Supersedes SP 800-63B, which was withdrawn on 1 August 2025.
4. CISA — Secure Our World: Secure Your Business— CISA's current small business campaign and its five named actions.
5. CISA — Cyber Guidance for Small Businesses— the deeper technical companion, organised by role. Source for "Ensure MFA is mandated using technical controls, not faith" and "Remove administrator privileges from user laptops."
6. CISA — Implementing Phishing-Resistant MFA— October 2022. Source for the assessment of SMS and voice one-time passcodes as a last-resort option vulnerable to phishing, SS7 and SIM-swap attacks.
7. CISA — Cross-Sector Cybersecurity Performance Goals— source for changing default passwords (2.A), separating user and privileged accounts (2.E), revoking departing employee credentials by the day of departure (2.D), and backup testing (2.R).
8. CISA, FBI, NSA and MS-ISAC — #StopRansomware Guide— source for offline encrypted backups, regular restore testing, and the caution on immutable storage.
9. CISA — More than a Password— on prioritising your most-used accounts, FIDO/WebAuthn as the only widely available phishing-resistant method, and number matching as an interim measure.