The 10-point security baseline every small business needs

Attackers rarely pick small businesses because they are interesting. They pick them because they are easy: a reused password, an inbox without multi-factor authentication, a backup that sits on the same network as everything else. The goal of a security baseline is simple — make your company more expensive to attack than the next one.

Here are the ten controls we check first in every Security Baseline Assessment.

Identity

1. Multi-factor authentication everywhere. Email, accounting, banking, payroll, remote access. Prefer an authenticator app or passkeys over text messages.
2. A password manager for the whole team. It is the only realistic way to have unique passwords for every service.
3. Separate admin accounts. The account that can change everything should not be the one that opens email attachments.
4. An offboarding checklist. When someone leaves, their access to every system is removed the same day.

Devices

5. Automatic updates for operating systems, browsers and common apps.
6. Disk encryption on every laptop (BitLocker or FileVault), so a lost device is an inconvenience, not a data breach.
7. Endpoint protection with central alerts — built-in tools like Microsoft Defender are sufficient for most small teams when they are actually monitored.

Data and recovery

8. Backups following the 3-2-1 rule: three copies, two different media, one off-site and ideally immutable.
9. A tested restore. Pick one important folder each quarter and restore it. A backup you have never restored is a hope, not a plan.

People

10. A simple rule for money and data requests. Any request to change bank details, pay an unusual invoice or share sensitive data is confirmed by phone using a number you already have — never one from the email.

Rule ten alone would prevent most business email compromise losses we have seen.

Write it down

A one-page security policy that lists these ten points, who owns each one and when it was last checked is worth more than an expensive tool nobody configures. It also answers most of the questions on cyber-insurance applications.