Five security steps every small organization should take this year

Most security incidents at small organizations do not start with a sophisticated attack. They start with a reused password, a missed update, or a convincing email.

1. Turn on multi-factor authentication for email and every remote access tool.

2. Keep operating systems and applications patched automatically.

3. Back up critical data, keep a copy offline, and test restoring it.

4. Give people only the access they need, and remove it promptly when roles change.

5. Train your team to recognize phishing, and make it easy to report a suspicious message.

None of these require a large budget. Together they remove a large share of everyday risk.