Small business IT security guides
Plain-English guides to cyber-insurance readiness, incident response and security policies for businesses with 5-100 employees. Every guide cites its sources.
Cyber insurance MFA requirements: what small businesses should have in place before renewal
Which logins cyber-insurance applications commonly ask you to protect with MFA, how to check your own setup, and how to document it before renewal.
Read guideHow to write an incident response plan for a small business (without a security team)
A practical, step-by-step way for a small business to write an incident response plan people will actually use: roles, contacts, severity levels, playbooks and testing.
Read guideCyber insurance application checklist: what to gather before you fill it in
The controls cyber-insurance applications commonly ask small businesses about (MFA, EDR, backups, patching, training, incident response, payment controls) and the evidence to gather first.
Read guideWriting a password policy in 2026: what current NIST guidance actually says
Modern password policy guidance for small businesses based on NIST SP 800-63B-4: length over complexity, no forced rotation, blocklists, password managers and MFA.
Read guideAcceptable use policy for a small business: what to include (and what to leave out)
What a small-business acceptable use policy should cover in 2026, including devices, accounts, email, generative AI tools, personal use and monitoring, plus how to roll it out.
Read guideStopping business email compromise and wire fraud: a small-business playbook
Practical controls to stop business email compromise (BEC) and payment-redirection fraud at a small business: verification calls, dual approval, mailbox hardening and what to do if money is sent.
Read guide