SMB Cybersecurity Essentials: A 30-Day Plan Based on CISA Guidance

A small business can spend its first month writing policies and still be unable to recover its accounting system. Use that month to test a few controls around the services the company cannot afford to lose.

CISA's small and medium business resources cover foundational security practices. The sequence below is a suggested implementation plan, not a CISA certification or a promise that thirty days will address every risk.

Week one: choose the services and the people

Meet with the people responsible for payroll, customer delivery, finance, and IT. Ask which outage would stop their work, how long they could operate manually, and which vendor they would call. Include email and identity because other services may depend on them.

Select a manageable first scope. For a hypothetical professional-services firm, that could be email, the customer document store, and accounting. Record the owner, administrator, vendor contact, sensitive data, and recovery dependency for each. Name a backup contact rather than relying on one employee's memory.

Ask the MSP or internal administrator to demonstrate access to the management consoles. Establish who owns the subscriptions and recovery accounts. Discovering that the former provider controls the only recovery address is actionable work for this week.

Week two: test sign-in and recovery

Review administrators and finance users first, then extend the review to other staff. Require suitable MFA, remove unused access, and provide a password manager where needed. Check actual enforcement with an authorized test account; an enrollment report alone does not show which applications still allow a weaker route.

Walk through the lost-device process with support. Decide how the company verifies a reset request and how a second authorized person can obtain emergency access. Keep recovery codes and credentials in approved protected storage, not in the control spreadsheet.

Week three: reduce exposed software risk

List internet-facing systems and remote-management tools, including those maintained by suppliers. For each, identify who receives advisories, who installs updates, and how completion is verified. Use the patch-triage procedure for urgent findings and documented delays.

Pick one pending update and follow it through testing, change approval, installation, and business validation. If nobody can authorize a restart, resolve that decision path. Avoid counting an emailed request to a vendor as a completed fix.

Week four: restore something and practice reporting

Recover a representative file or application dataset to a separate location. Have its business owner check that it is complete and usable. Record the backup point, elapsed time, missing dependencies, and any manual steps. A partial restore establishes only the capability tested; schedule broader recovery testing for critical services.

Give staff a simple way to report suspicious messages or access problems. Verify that someone receives the report after hours. Keep bank, insurer, legal, IT, and important supplier contacts available outside the normal email system.

Keep a small control register

Add an owner, verification date, and next review date to each row. Leadership should review unresolved items and resource decisions at the end of the month. Keep the register short enough to maintain, and expand scope after the first controls have working evidence.