GUIDE

The security basics every small business needs

Darshan Savkar (opens in new tab) · Published 17 October 2026 · Last reviewed 17 October 2026 · 4 min read

Why start with CIS IG1

The CIS Critical Security Controls (opens in new tab) are a widely used, freely available set of security practices. Version 8.1 groups its safeguards into three Implementation Groups. CIS Implementation Group 1 (opens in new tab) is the minimum every organisation should meet, whatever its size: 56 safeguards that defend against the most common attacks without needing a security team.

IG1 is also a sensible first step towards larger frameworks. If a client, insurer or auditor later asks about ISO 27001 or a security questionnaire, most of the basics below are what they check first.

1. Know what you have

You can’t protect a laptop or an app you don’t know about.

• ☐Keep one list of every device that touches company data: laptops, phones, servers, network equipment. Note the owner and where it is (CIS Safeguard 1.1).
• ☐Keep a list of the software and cloud services you use, and remove anything unsupported or unapproved (Safeguards 2.1 to 2.3).
• ☐List the service providers that hold or access your data, such as your email host, accountant’s portal and IT provider (Safeguard 15.1).

2. Lock down accounts

Stolen passwords are behind a large share of break-ins. Accounts are where small businesses get the most protection for the least effort.

• ☐Turn on multi-factor authentication (MFA) for email, cloud apps, remote access and every admin account (Safeguards 6.3 to 6.5).
• ☐Give everyone their own account. No shared logins.
• ☐Use a separate admin account for admin work, not the account you read email with (Safeguard 5.4).
• ☐Disable accounts that haven’t been used for 45 days (Safeguard 5.3).
• ☐Write down how access is granted and removed, and follow it every time someone joins, moves or leaves (Safeguards 6.1 and 6.2). Our onboarding and offboarding checklist covers this step by step.

3. Configure and patch automatically

• ☐Set devices to lock automatically: after no more than 15 minutes on computers, and 2 minutes on phones and tablets (Safeguard 4.3).
• ☐Turn on the built-in firewall on every computer and server (Safeguards 4.4 and 4.5).
• ☐Turn on automatic updates for operating systems and applications, and check monthly that they actually ran (Safeguards 7.3 and 7.4).
• ☐Change default passwords on routers, printers and other network devices, and keep their firmware up to date (Safeguards 4.7 and 12.1).

4. Protect data and keep backups you can restore

• ☐Encrypt the storage on every laptop and phone (Safeguard 3.6). Windows, macOS, iOS and Android all include this.
• ☐Know where your sensitive data lives (customer records, contracts, payroll) and who can access it (Safeguards 3.1 to 3.3).
• ☐Back up important data automatically, at least weekly (Safeguard 11.2), and keep one copy separate from your main systems so ransomware can’t reach it (Safeguard 11.4).
• ☐Test a restore regularly. A backup you have never restored is a hope, not a plan.

5. Defend email, browsers and devices

• ☐Use only supported, up-to-date browsers and email clients (Safeguard 9.1).
• ☐Use DNS filtering to block known malicious websites (Safeguard 9.2).
• ☐Run anti-malware on every device, with automatic updates (Safeguards 10.1 and 10.2), and turn off autorun for removable media (Safeguard 10.3).
• ☐Publish SPF, DKIM and DMARC records for your email domain so others can’t easily send email pretending to be you.

6. Prepare your people and your response

• ☐Train everyone to spot phishing, handle data safely and report mistakes quickly, at hiring and at least yearly (Control 14).
• ☐Name one person who leads when something goes wrong, plus a backup (Safeguard 17.1).
• ☐Keep a contact list for an incident: your IT provider, insurer, bank, lawyer, and any regulator you must notify (Safeguard 17.2). In India, many organisations must report certain cyber incidents to CERT-In within 6 hours; see our CERT-In and DPDP guide.
• ☐Tell staff exactly how to report a suspected incident, and make it safe to do so (Safeguard 17.3).

A 30-day starting plan

IG1 doesn’t include network monitoring, application security testing or penetration testing. Those come in Implementation Groups 2 and 3, once the basics are in place.

Sources

• Center for Internet Security, CIS Critical Security Controls (opens in new tab), version 8.1.
• Center for Internet Security, CIS Implementation Group 1 (opens in new tab).

This guide is general information, not legal advice. Laws and standards change; check the primary sources linked below, and ask your lawyer how they apply to your business. See our editorial and claims policy for how we write and review guides. Found an error? Email hello@zaivit.com with the subject "Correction".