If you run a business by yourself, cybersecurity can feel like one more job on an already crowded list. Yet your email account, invoices, customer files and business website may all depend on just a few devices and passwords. One compromised account can disrupt everything.
Those numbers help explain why a guide for one-person businesses matters. You do not need expensive enterprise software to start improving your security — but you do need a repeatable plan.
01
Secure your primary business email first
Your business email may be the key to password resets for payment accounts, scheduling tools, domain registrars and customer platforms. If an attacker takes over your inbox, they might be able to reset other passwords or send convincing invoices in your name.
- Check the account’s recent sign-ins and recovery options.
- Use a strong password that you do not use anywhere else.
- Enable the strongest multi-factor authentication method the provider supports.
- Remove unknown forwarding rules, connected apps or recovery contacts.
02
Use a unique password for every important account
Reusing a password creates a domino effect. If one website exposes login credentials, criminals can test the same details against your other services. A reputable password manager can generate and store long, unique passwords, reducing the temptation to reuse them.
Give the password manager itself a strong master passphrase, enable MFA where available, and understand its recovery options. Never store passwords in a publicly accessible spreadsheet.
03
Enable multi-factor authentication (MFA)
MFA adds a second proof of identity beyond a password. Where supported, phishing-resistant passkeys or hardware security keys can be especially valuable for your email, financial accounts and website administration. Authenticator apps are another useful option; SMS verification is generally better than password-only access but has limitations.
Keep your backup codes somewhere secure and avoid approving unexpected sign-in prompts. For a full explanation, read our two-factor authentication guide.
04
Update your laptop, phone, browser and business tools
Security updates address known vulnerabilities. Turn on automatic updates for your operating system and frequently used apps, then check that important business tools — including WordPress plugins and website themes — are still supported. Replace software that no longer receives security fixes.
Also use device-screen locks, reputable built-in or third-party security protection and encryption where available. Do not leave unlocked business devices in shared workspaces.
05
Back up important business data — and test recovery
Customer documents, invoices, tax records and project files can disappear because of device failure, accidental deletion or ransomware. Keep an automated backup routine and an additional protected copy that a compromised device or account cannot easily overwrite.
- Identify the files you could not afford to lose.
- Choose a reliable backup method with version history or offline isolation where suitable.
- Restrict access to backup accounts.
- Restore a sample file periodically to confirm backups actually work.
Cloud sync alone is not always a complete backup strategy. See our related guide: Is Cloud Storage Safe?
06
Check suspicious emails, payment changes and AI-assisted scams
Phishing messages can impersonate banks, software vendors, delivery companies and even existing clients. AI-generated writing and voice cloning can make some scams harder to notice, so polished language or a familiar voice is not proof that a request is genuine.
If a message demands an urgent transfer, a password reset or a change to payment details, verify it independently using a phone number or website you already trust. Do not rely on contact details supplied in the suspicious message.
Learn more in our article on recognizing AI-generated scams.
07
Secure your router and working Wi-Fi
Change default administrator passwords on routers and other internet-connected devices. Install firmware updates and use modern Wi-Fi encryption such as WPA3 or WPA2-AES when supported. Consider a separate guest network for visitors and devices that do not need access to your business equipment.
When using public Wi-Fi, verify the network, avoid sensitive operations on untrusted systems, and consider your organization’s requirements for a trusted VPN. A VPN does not make phishing or compromised devices safe.
08
Give apps and contractors only the access they need
Review who can access your website, cloud storage, accounting platform, design tools and social accounts. Remove old accounts and revoke access after a project ends. Use separate accounts rather than sharing your own login, and reserve administrator privileges for tasks that require them.
Keep a simple inventory of important accounts, hardware and software. That makes it easier to see where a risk might affect your business — a core idea behind NIST’s practical approach.
09
Review the security of services you depend on
Many solo businesses rely on external services for payments, bookings, storage and email. Check whether each provider supports MFA, offers sensible recovery options, publishes clear security information and allows you to export essential business data.
Do not assume a paid subscription automatically means better security. Compare the protections that matter for your particular workflow, and review unfamiliar integrations before giving them access to customer records.
10
Write a basic cyber incident response plan
If your accounts are breached or your laptop is infected, you will make better decisions with a short plan already prepared. Keep trusted support numbers, a list of critical accounts, backup instructions and the steps you would take to protect customers and contain an incident.
| If this happens | First sensible steps |
|---|---|
| Suspicious email login | Use a trusted device to secure the account, revoke suspicious sessions, review MFA and forwarding rules. |
| Possible malware or ransomware | Disconnect the affected device from networks where appropriate; preserve evidence and seek qualified help before restoring systems. |
| Fraudulent payment request | Contact the financial institution immediately through its official channels, then document the incident. |
| Customer data may be exposed | Assess what was affected and seek qualified guidance on applicable notification and contractual obligations. |
Reporting requirements vary by US state, industry and the type of information involved. This article is general information, not legal or incident-response advice.
✅ Free Small Business Security Checklist
Tick each action you have completed. The progress bar updates instantly. The checklist works in your browser and does not send your answers anywhere.
How to prioritize security when time is limited
You do not need to finish everything in one day. Start with steps that reduce the risk of losing access to your essential business systems.
Today · 20 minutes
Secure email, check MFA and update recovery options.
This week
Fix reused passwords, install updates and review backups.
This month
Review account permissions, test restoration and write a response plan.
Frequently Asked Questions
Do freelancers really need cybersecurity?
Yes. A freelancer may handle customer details, invoices and online payments using the same devices and accounts that support the entire business. Basic protections help reduce that risk.
Is the new NIST small-business guide free?
Yes. NIST CSWP 50 is available publicly from the official NIST website, along with supplemental resources and worksheets.
What should a one-person business secure first?
Start with the primary email account, financial and payment accounts, website administration, and a reliable backup of important records. Then review devices and other services.
Do I need to buy antivirus software or a VPN?
Not necessarily. Start by evaluating the built-in protection on supported devices and the specific risks of your work. Additional paid products may be useful in some cases, but they do not replace updates, MFA, backups and careful account management.
Does following these steps make my business fully protected?
No. Cybersecurity is an ongoing risk-management process. Your needs may differ depending on your customers, technology, industry rules and contractual obligations.
The bottom line
For solo business owners, cybersecurity does not have to begin with complex software or an expensive consultant. Begin with secure accounts, MFA, updates, dependable backups and a simple incident plan. NIST’s new 2026 guidance provides a useful framework for building stronger practices as your business grows.
Editorial note: This article provides general educational information and is not a security audit or legal advice. Check official guidance for your industry and jurisdiction.
Leave a Comment