What cybersecurity basics does the FTC recommend for small businesses?

Published 2026-10-30

Small businesses do not need a superhero SOC to get the basics right. The FTC’s small-business cybersecurity guidance is built around practical, foundational steps: keep systems updated, use strong passwords and multi-factor authentication, back up data, encrypt sensitive information, train people to spot phishing, limit access, secure networks, and have a simple recovery plan. That lines up with the FTC’s small-business cybersecurity guidance and with core advice on patching, authentication, backups, and incident response. The point is not perfection. It is making life annoyingly difficult for attackers.

Keep software, systems, and devices up to date

The FTC recommends prompt security updates and patching for operating systems, apps, routers, and other connected devices. Update it, patch it, and stop leaving known holes open.

CISA’s guidance on software updates and patching supports the same basic idea, keep software current so known security issues get fixed. For a small business, that means checking desktops, laptops, mobile devices, email software, accounting tools, routers, printers, and anything else connected to the network. If it can be updated, it should be.

Use strong passwords and multi-factor authentication

The FTC also recommends strong, unique passwords and multi-factor authentication. In plain English, do not reuse the same password everywhere, because once one account gets popped, the rest can fall like dominoes. A password manager can help you keep track of unique passwords, but the basic rule is still simple: every important account gets its own strong password.

Multi-factor authentication adds another layer, usually a second proof that it is really you. NIST’s authentication guidance explains why MFA is a core control, because a password alone is rarely enough anymore. See the FTC’s guidance on passwords and multi-factor authentication and NIST’s digital identity guidance for the general principles behind stronger authentication.

Back up important data and protect the backups

The FTC advises small businesses to back up critical data and protect those backups. The simple version, keep copies of the files you cannot afford to lose, and keep them in a place an attacker cannot easily encrypt or delete. Offline or otherwise protected backups are especially useful if ransomware hits, a laptop dies dramatically, or an account gets compromised.

CISA’s backup guidance supports the same approach, because backups are what let you recover without negotiating with your own bad luck. For a small business, that means protecting customer records, financial files, email archives, and any other data you would rather not rebuild from memory and panic.

Encrypt sensitive information

Encryption turns readable data into something that is not useful without the right key. In everyday terms, it is like putting sensitive files in a locked box instead of leaving them on the seat of a parked car.

The FTC treats encryption as an important safeguard for sensitive information, especially if a device is lost, stolen, or an email account is compromised. NIST also covers encryption as a standard security measure for protecting data. The FTC’s small-business cybersecurity materials and NIST’s security guidance both point in the same direction, sensitive data should not sit around in plain text hoping for the best.

Train employees to spot phishing and scams

The FTC tells businesses to train employees to recognize suspicious emails, links, invoices, and password reset requests. That advice matters a lot in business-email-breach situations, because one convincing phish can turn into a mailbox takeover, fraudulent payments, or a very awkward reply chain.

CISA’s phishing resources back up the same basic behavior, slow down, check the sender, inspect links, and treat surprise requests for money or credentials with suspicion. Training does not have to be fancy. People just need to know what normal looks like, what suspicious looks like, and who to ask when something feels off.

Limit access to data and use separate accounts

The FTC recommends giving people only the access they need, avoiding shared accounts, and removing access when roles change. That is just sensible damage control. If one account gets compromised, the attacker should hit a wall quickly, not stroll through the whole business like they own the place.

This also reduces the blast radius if a mailbox is breached. Separate accounts make it easier to see who did what, and they make it easier to shut down access fast when someone leaves or changes roles. NIST guidance on access control follows the same logic, least privilege is boring, and that is exactly why it works.

Secure Wi-Fi, routers, and remote access

The FTC also recommends basic network hygiene, change default settings, use secure Wi-Fi, and lock down remote access tools. Default router passwords and open remote access are the cybersecurity equivalent of leaving a spare key under the mat and labeling the mat "spare key here."

CISA guidance on router and Wi-Fi security supports these steps. For small businesses, that means changing default admin settings, using protected wireless networks, and checking whether remote access features are actually needed. If they are needed, restrict them as tightly as possible.

Create a simple incident-response and recovery plan

The FTC expects small businesses to have a practical plan for what to do when something goes wrong. That includes knowing who to contact, how to isolate affected systems, how to restore data, and how to keep the business running while the mess is contained.

You do not need a cinematic war room. You need a short, usable plan that answers basic questions before everyone is under pressure. Who shuts off access? Who checks backups? Who talks to customers? Who makes the tea, because at some point the tea becomes critical infrastructure?

Worked example: if a business email shows up in a breach

Say you get an alert that an employee email address appeared in a breach. The FTC basics to prioritize first are straightforward.

Change the password for that account, and any other account that reused the same password. Turn on multi-factor authentication if it is not already enabled. Check whether important data is backed up, and make sure those backups are intact and protected. Review who has access to the mailbox and any connected apps, then remove anything that does not belong there. Finally, warn employees to watch for phishing, especially messages that ask for money, login codes, or password resets.

That sequence is not flashy, but it is useful. It cuts off common follow-on attacks and buys time while you figure out what actually happened.

Closing takeaway: the FTC basics that matter most

Start with updates, strong authentication, backups, encryption, employee training, access limits, secure networks, and a recovery plan.