Cyber Security Services for Small Businesses
Start by listing what your business can't run without and who already looks after it. That shows where the gaps are, which tells you whether you need outside services at all, and which ones.
On this page
Three starting points
We have no dedicated IT staff
Ask: who controls our email and domain? Who can reset passwords? Is multifactor authentication on?
We have an IT provider
Ask: is security in our contract, or only support? Who responds at night? When was our backup last restored?
We need help after an incident
Ask: who is our insurer or attorney? What must we preserve? Must we notify anyone?
Report to the FBI Internet Crime Complaint Center and CISA, and see how to check a response provider.
Example: a bakery's inventory
A 12-person bakery with online orders
This business is invented. In an hour, the owner lists what matters and spots the gaps.
| Essential item | Who supports it | Gap |
|---|---|---|
| Business email and domain | Former employee's personal account | Owner can't recover it, so move it to a business account |
| Online ordering site | Web vendor | Contract doesn't say who responds to a breach |
| Card payments | Payment processor | Ask processor what's required of the bakery |
| Bookkeeping files | Owner's laptop | No tested backup |
| Staff accounts | No one | No removal process when people leave |
Most of these need decisions, not a security purchase. Only then does the owner decide what to outsource.
First-meeting checklist
Use this with any provider or IT firm:
- Show them your inventory, and ask what they would and wouldn't cover
- Ask who would respond if your email were taken over on a Saturday
- Ask what they need you to do, not just what they will do
- Ask what you'd own if you ended the contract, including accounts and data
- Ask for pricing in writing, including setup and incident work
- Ask how they protect their own access to your systems
Use the quote worksheet to compare answers.
Official U.S. small-business resources
| Resource | Use it for |
|---|---|
| CISA: Cyber Guidance for Small Businesses | A plain plan, starting with who is responsible |
| FTC: Cybersecurity for Small Business | Basics, plus materials to share with staff |
| NIST: Small Business Cybersecurity Corner | Guides and planning tools from NIST |
| SBA: Strengthen your cybersecurity | Small-business basics |
| SBA: Small Business Development Centers | Local no-cost or low-cost counseling |
| FCC: Cybersecurity for Small Businesses | Tip sheet and planning tool |
Staff are often where attacks start. Compare training that fits a small team.
Compare training options