Short answer: The minimum security a small company needs is eight basics: multi-factor authentication, a password manager, updated and encrypted devices, tested backups, a protected email domain, limited access with an offboarding checklist, a team that reports mistakes early, and a simple inventory with a one-page incident plan. Done properly and kept up, these stop most everyday threats, such as stolen logins, hijacked email and ransomware, without an enterprise security program. Here is each one in plain language.
One of the more common questions we hear from founders and small teams: “We do realize the growing need for security, but we’re small and don’t have a security department. What’s the minimum we actually need?”
It’s a good question, and the honest answer is not “everything.” Small companies don’t need an enterprise security program. They need a short list of basics, done properly and kept up. Many real-world incidents at small businesses, like stolen logins, hijacked email, ransomware and lost laptops, are stopped by those basics, not by expensive tools.
The eight basics at a glance
Multi-factor authentication on everything that matters
A password manager for everyone
Devices and software kept updated, with encrypted laptops
Backups you have actually tested
A protected email domain, so nobody can fake your address
Access limited to what each person needs, plus an offboarding checklist
A team that knows what to spot and feels safe reporting mistakes
A simple inventory and a one-page incident plan
Here is the baseline we’d want in place at any company, whatever its size.
1. Multi-factor authentication on everything that matters
If you do only one thing, do this. Turn on multi-factor authentication (MFA), the extra login step that asks for a second proof of identity, for email, your cloud storage, your accounting and banking tools, your code storage (such as GitHub, if you have any) and your admin accounts. Stolen passwords are one of the most common ways in, and MFA turns a stolen password from a disaster into a much smaller problem.
Where you can, prefer an authenticator app over SMS codes. For admin and finance accounts, go a step further with passkeys (logging in with your fingerprint or face instead of a password) or a hardware key (a small USB key you tap to log in). Both also resist phishing.
2. A password manager for everyone
People reuse passwords because remembering dozens of strong ones is impossible. A password manager removes the problem: unique, long passwords everywhere, shared safely between team members instead of pasted into chats or spreadsheets. It also gives you one place to cut off access when someone leaves.
3. Keep devices and software updated
Most attacks use known weaknesses that already have a fix. Turn on automatic updates for operating systems, browsers and the apps your team uses every day. Replace anything that no longer receives security updates.
Alongside that, make sure every laptop has:
Disk encryption switched on (BitLocker on Windows, FileVault on Mac), so a lost or stolen device is an annoyance, not a data breach.
A strong login password, with fingerprint or face unlock as a convenience on top.
A screen lock with a sensible timeout.
Antivirus and similar protection, which today often means the tools built into your computer, properly switched on and monitored.
4. Backups you have actually tested
A backup you’ve never restored is a hope, not a plan. A good rule of thumb is 3-2-1: three copies of your important data, on two different types of storage, with one copy kept offsite. Make sure at least one copy is out of ransomware’s reach: disconnected from your network, or locked so it can’t be changed or deleted. Then test a restore at least once or twice a year. The day you need it is a bad day to find out it doesn’t work.
5. Protect your email domain
Email is where most attacks begin. SPF, DKIM and DMARC are three settings on your domain that prove an email really came from you. Together they make it much harder for criminals to impersonate you to your customers and partners, and they improve the chance your own emails land in the inbox. Your IT provider or email administrator can set them up and check them for you.
One detail matters here: DMARC is often left on “monitor only” (you may see it written as p=none). That reports on fake emails but doesn’t block them. Once you’ve checked that your legitimate senders (your email provider, newsletter tool, invoicing system) pass, switch DMARC to enforcement, so that fake emails are rejected or sent to spam. Combine it with the spam and phishing filtering your email provider already offers.
6. Give people only the access they need
Not everyone needs to be an admin. Give each person access to what their job requires, and review it now and then. Just as important: have a simple offboarding checklist, so when someone leaves, their accounts, devices and access are closed the same day.
7. Teach your team to spot the obvious
You don’t need a long training course. A short, regular conversation about phishing, fake invoices, urgent requests from “the CEO” and what to do when something feels off goes a long way. The most important rule: make it easy and blame-free to report a mistake early. Fast reporting is worth more than perfect behavior.
8. Know what you have, and what to do when it goes wrong
Keep a simple list of your systems, your key suppliers and where your sensitive data lives. You can’t protect what you don’t know about. Then write one page on what happens during an incident: who decides, who to call, how to disconnect a device from the internet, who tells customers. A one-page plan used calmly beats a thirty-page plan nobody has read.
What this baseline won’t do
These eight points are a floor, not a ceiling. They’ll protect you against the large majority of everyday threats. But the “minimum” moves as your company grows. It usually changes when:
A larger customer sends you a security questionnaire you’re not sure how to answer.
Your clients or investors start asking about security certifications such as ISO 27001 or SOC 2.
You start handling more sensitive or regulated data.
Your team grows and “everyone just knows how we do things” stops working.
At that point, the question isn’t really “what’s the minimum?” anymore. It becomes “who owns security here?”, and many small companies aren’t ready to hire a full-time CISO (a chief information security officer, the person responsible for security) to answer it.
A practical way to start
If you’re not sure where you stand, don’t try to fix everything at once. Take the eight points above, mark each one as done, partly done or not done, and start with the gaps that are cheapest to close: MFA, updates and a tested backup usually come first.
The checklist itself is easy to write. Keeping it up as the company grows is harder without someone who owns it. If you’d like an experienced second pair of eyes, that’s exactly what a fractional CISO is for. This is a part-time security leader who gives you clear priorities and a realistic roadmap, and who helps you answer customer security questionnaires and prepare for ISO 27001 or SOC 2 audits, all without the cost of a full-time hire.
Want to know how your company compares to this baseline? Get in touch with Swenfort for a short, no-pressure conversation.