Digital hygiene for your business: the 1-50 person baseline

You don't need a security team to cover the basics that stop everyday, untargeted attacks; you need one person who owns them. Small-business guidance from the Cybersecurity and Infrastructure Security Agency (CISA), the starter set (Implementation Group 1) of the Center for Internet Security (CIS) Controls, and the Small Business Quick-Start Guide to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 all land on the same short list: strong sign-in, updates, backups, trained people and a plan.²³⁴ AI makes old scams more convincing rather than different: in 2025, businesses told the FBI they lost more than $30 million to email-impersonation scams that involved AI.¹

1. 1

   Step 1: Make one person the owner and write down what you have

   Pick one person, often the owner or office manager, to own security and report on it at least monthly. CISA's guidance says the CEO should back that person visibly and personally drive MFA enrollment, because culture can't be delegated.²

   List your accounts (email, bank, payroll, accounting, cloud storage, domain registrar, social media), who has admin rights to each, and every laptop and phone that touches company data. NIST's quick-start guide starts the same way: decide who is responsible, and know what you'd lose if a system went down.⁴

   How you know it worked

   You have a one-page list of accounts, admins and devices, with a named owner and the date it was last checked.

2. 2

   Step 2: Put passkeys or MFA on every account, email and banking first

   Turn on MFA, a second proof beyond the password, for every account that offers it. NIST calls MFA one of the fastest, cheapest protections you have and suggests starting with banking, accounting and tax, merchant, email, password manager and Google, Microsoft or Apple accounts.⁴ CISA adds that administrator accounts must always have it.²

   Prefer phishing-resistant options, meaning passkeys or hardware security keys, which CISA recommends for small and medium businesses.⁵² In Microsoft 365 or Google Workspace, enforce MFA for everyone from the admin console instead of asking nicely, and check for gaps when people join or change phones.²

   How you know it worked

   Your email platform's admin report (Microsoft or Google) shows every user enrolled in MFA, and your bank's portal requires a second factor for everyone who can move money.

3. 3

   Step 3: Give the team a password manager

   A business password manager gets passwords out of spreadsheets and sticky notes, lets you share logins by role, and makes offboarding faster. Bitwarden Teams costs $4 per user a month and 1Password Business $8.99, both billed annually; 1Password's Teams Starter Pack covers 10 people for $24.95 a month.⁶⁷

   Set up shared vaults by role, such as finance, operations and social media, and require everyone to use it for work accounts. NIST's quick-start guide recommends password managers alongside MFA, and changing every default manufacturer password.⁴

   How you know it worked

   Every shared login lives in a shared vault, and the old password spreadsheet is deleted.

4. 4

   Step 4: Turn on automatic updates and endpoint protection

   Turn on automatic updates for operating systems, browsers and apps on every work device, and patch anything on CISA's Known Exploited Vulnerabilities catalog first. Remove administrator rights from everyday accounts and turn on full-disk encryption on laptops.²⁴

   Run endpoint protection on every computer. On Microsoft 365, Defender for Business is included in Business Premium or sold alone for $3 per user a month.⁸ The office router and firewall need updates too.

   How you know it worked

   Your device list shows every laptop updated within the past month, encrypted, and reporting to your endpoint protection.

5. 5

   Step 5: Back up, then prove you can restore

   Back up company data on a schedule, and keep at least one copy that ransomware can't reach, such as an offline drive or a backup service with version history. CISA tells small businesses to test both partial and full restores and to write the restore steps down.²

   Don't assume your email and file platform is your backup. Ask Microsoft, Google or your outside IT company how long deleted files and mailboxes can be recovered, and whether that meets your needs. After an incident, NIST advises checking that the backup itself is intact before you restore from it.⁴

   How you know it worked

   This quarter, someone restored a real file and a whole folder or mailbox from backup, timed it, and wrote down the steps.

6. 6

   Step 6: Verify every payment change on a second channel

   Business email compromise (BEC), where a criminal poses as a boss or vendor to redirect money, drew $3.05 billion in reported losses to the FBI in 2025.¹ AI now helps criminals write convincing emails and clone voices, so the defense has to be a habit, not a hunch.⁹

   Before paying a new account or changing anyone's bank details, call back on a number you already had, never one from the request, and require two people to approve payments above a set amount. Our two-channel verification guide has policy wording you can copy.

   If money does go out, call your bank immediately to request a recall, then file at ic3.gov. In 2025 the FBI's Recovery Asset Team froze $679 million, about 58% of the money in the cases it handled.¹

   How you know it worked

   Walk through a pretend bank-change request from a real vendor: the person handling it calls the known number and gets a second approver before anything changes.

7. 7

   Step 7: Write a one-page AI rule and pick an approved tool

   Assume someone on your team already uses AI. Decide which tools are approved, which account to use, and what never goes in: client records, health or financial details, passwords, and anything under a confidentiality agreement.

   ChatGPT Business, Claude Team and Microsoft Copilot Chat with a work account say they keep your data out of model training by default, and Google says Workspace data isn't used to train models outside your domain without permission.^10111213 Personal accounts are different: on ChatGPT's personal plans, for example, content is used for training unless the user opts out.¹⁴

   Our one-page AI use rule guide walks through the wording, and the AI Acceptable Use Policy in our Policy Library (free account required) turns it into a full policy.

   How you know it worked

   Everyone has acknowledged the one-page rule in writing, and your approved tool's admin console shows staff signed in with work accounts.

8. 8

   Step 8: Offboard the same day

   When someone leaves, disable their accounts that day, remove them from shared vaults, and change any shared passwords they knew. Transfer ownership of their files and email, collect or wipe company devices, and remove company data from their personal phone.

   Check the less obvious places too: bank and payroll portals, the domain registrar, social media, and any AI tools or browser extensions connected to company data. NIST's quick-start guide asks whether access is removed when people no longer need it, and the CIS Controls give account management and access control management their own controls.⁴¹⁵

   How you know it worked

   For the last person who left, you can show the date each account was disabled, and none of their old sign-ins work.

9. 9

   Step 9: Write a one-page incident plan and practice it

   Decide now who leads if something goes wrong, and who calls the bank, your IT provider, your insurer and a lawyer. Keep those numbers somewhere other than your computers. NIST's Respond section starts with knowing your plan and who has authority, and CISA recommends drilling the plan and reviewing it at least once a year.⁴⁵

   Report fraud and cybercrime to the FBI at ic3.gov and cyber incidents to CISA.¹⁵ Our Incident Response Planner builds a plan with playbooks for deepfake payment fraud and AI data exposure, and our Cyber Audit shows where your baseline has gaps.

   How you know it worked

   Your plan fits on one or two pages, a printed copy lives outside your computers, and the team has walked through one scenario in the past year.

• This is a baseline, not compliance. Healthcare practices, financial firms and businesses that take card payments have specific legal duties this guide doesn't cover.
• Settings only help once they're configured and checked. Re-run the verify steps every quarter, and after any change of IT provider.
• AI vendors change their terms and features often. Re-check your approved tool's data terms at least once a year and whenever it announces new connections to your data.
• No baseline stops a determined, targeted attacker. It's built for the common, untargeted attacks that the CIS starter set is designed against.³

• ThreatHomeBusiness

  AI-powered phishing and business email compromise

  Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.

  Read
• ThreatHomeBusiness

  Voice cloning and deepfake scams

  Criminals can copy a voice from a short clip and fake faces on a video call, then use them to ask for money in a hurry. In 2025 the FBI logged 22,364 complaints that mentioned AI, with losses near $893 million, most of it in investment scams; voice-cloned 'distress' calls alone cost victims more than $5 million. The defense is low-tech: pause, hang up, and confirm through a number or channel you already trust.

  Read
• ThreatHomeBusiness

  AI chatbot data leaks and shadow AI

  Whatever you paste into an AI assistant can be stored, read by reviewers or used to train future models, depending on the app, the plan and your settings. In a 2025 survey of workers in 47 countries, 48% of those who use AI at work said they had uploaded sensitive company or customer information into public AI tools. The fix is mostly unglamorous: business accounts for work, the right settings at home, and a clear rule about what never goes in.

  Read
• ThreatHomeBusiness

  Prompt injection and AI agent hijacking

  When an AI assistant reads your email, files or web pages, it can mistake text written by a stranger for instructions from you. That is prompt injection, and when the assistant can also send, buy or delete things, an attacker can steer it. The UK's National Cyber Security Centre (NCSC) says it may never be fully fixed, so the safe move is to limit what your AI can reach and keep yourself in the approval loop.

  Read
• GuideBusiness

  Two-channel verification for payments

  Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.

  Read
• GuideBusiness

  A one-page AI use rule for your team

  Your team is probably using AI already, so the useful question is which tools, with what data, and who checks the result. This guide helps you write those answers on one page, get everyone to sign it, and review it twice a year. When you need more, our full AI Acceptable Use Policy generator uses the same structure and is free with a free account.

  Read
• GuideHomeBusiness

  Lock down your AI assistants

  Each major AI assistant has a training setting, a memory setting, connected apps and a way to delete history, and the defaults favor the vendor. This guide walks through ChatGPT, Claude, Gemini, Microsoft Copilot and Meta AI one at a time, with notes for business accounts. Plan on about five minutes per assistant.

  Read
• GuideHome

  Digital hygiene at home: the household baseline

  A safe household runs on a few habits: one password manager, passkeys or multi-factor authentication (MFA) on the accounts that matter, automatic updates, and backups you've actually tested. AI adds one more: a family safe word and a callback rule, so a panicked call that sounds like family gets checked before anyone pays. People 60 and older reported $7.7 billion in losses to the FBI in 2025, so bring older relatives into the plan.

  Read
• ExplainerHomeBusiness

  Who owns your AI conversations?

  In practice, the company that runs the assistant holds your conversations, and its terms decide who can read them, whether they train future models and how long they're kept. Some consumer plans, including ChatGPT's, use your chats for training unless you switch it off, while the major business plans say they don't by default. You can usually export or delete your chats, but deleting doesn't undo training that already happened, and legal holds can override deletion.

  Read