IT Security Basics for Small Offices, by Danielle Lemons

Most small office security problems start with ordinary habits: a shared password, an old computer nobody updated, or an email that looked routine. These basics cover the habits worth setting first.

Start with an inventory

List every computer, phone, tablet, printer, router and online account your business uses, along with who has access to each one. You cannot protect what you have not written down. Keep the list somewhere both the owner and the office manager can find it, and update it when equipment or staff change.

Turn on multi-factor authentication

Turn on multi-factor authentication for email, banking, your website login and any shared business tools. It asks for a second confirmation, such as a code from your phone, when someone signs in. It does not replace a good password, but it means a stolen password is much less useful on its own. Phishing and MFA basics for a small business explains how fake emails try to collect passwords and codes, and how to respond.

Use a password manager instead of sticky notes

Each account should have its own long password. A password manager creates and stores those passwords, so no one has to reuse one or write it on a sticky note. Choose one manager for the whole team, and make sure the business owns the account rather than an employee's personal login. Password managers for small teams covers how to set one up for a group.

Stop sharing logins

A shared login hides who did what, and it makes access hard to remove later. Give each person a separate account wherever the service allows it. For a shared inbox, such as billing or general info, use a shared mailbox that several people can open with their own sign-ins. Shared mailboxes instead of shared logins shows how to set one up.

Keep software and devices updated

Turn on automatic updates for operating systems, browsers and routers. Replace any device the manufacturer no longer updates, and plan that replacement before it becomes an emergency. An unsupported device is a weak point no matter how careful the people using it are.

Keep the office network separate from guests

Put visitors on a guest network that is kept apart from the network your computers and printers use. Change the default administrator password on your router, and check that its firmware is current. These steps take little time and close off some of the easiest ways into a small office network.

Back up what you cannot replace

Keep at least one copy of important files somewhere other than the office, and make sure the copy updates on a schedule. Test a restore now and then, because a backup you have never restored is only a guess. Small business backups covers what to include and how often to check.

Plan for departures

When someone leaves, remove their access to email, shared files, accounting tools and the password manager on the same day. Collect any company devices and check whether they hold business data. Then confirm the list of accounts they could reach. What to do the day an employee leaves lists the steps in order.

Write a one-page plan

Write one page that answers three questions: who to call when something goes wrong, where the backups are kept, and who can approve a change to access. Keep a printed copy in the office. During an incident, a written page is far easier to use than a memory of who set up what.

Next step

If the inventory turns up more gaps than you expected, start with the accounts that hold money and customer information, then work down the list. To talk through your own setup, call Danielle at 615-861-9042 or email danielle@directech.net.

For a broader view of what to check on a business website, see the Checklist, or browse the Writing page for longer guides.

Danielle Lemons is Vice President of Operations at DirecTech Connect. Her web design business, daniellelemons.com, is woman-owned and veteran-owned.