Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Cybersecurity Basics
Cybersecurity is a continuous process. Because your business, technologies, regulations/laws, and cybersecurity threats continue to change, your goal should be to always strive for continuous improvement in your cybersecurity risk management.
There are many ways you can improve your business’ cybersecurity. Here are a few basic steps to get you started:
- Understand that cyber threats are a business risk, and having strong cybersecurity is a competitive advantage.
- Require employees to enable multi-factor authentication (MFA), particularly phishing-resistant MFA, on all accounts that offer it.
- Require strong passwords and consider using a password manager.
- Regularly back up your data. Establish measures to protect and test your backups.
- Change default manufacturer passwords to ones that are unique to you.
- Install and maintain updated antivirus software.
- Update and patch all software when new versions are available.
- Learn how to protect your business from phishing and ransomware.
- Train employees on basic cybersecurity hygiene.
Learn more in this Back to Basics: Foundational Cybersecurity Practices for Small Businesses presentation held on August 20, 2026, with speakers from NIST, Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA).
Additional Resources:
- Cybersecurity Framework 2.0 Small Business Quick Start Guide - provides small-to-medium sized businesses (SMB), specifically those who have modest or no cybersecurity plans in place, with considerations to kick-start their cybersecurity risk management strategy using the NIST Cybersecurity Framework (CSF) 2.0.
NIST - Small Business Cybersecurity: Non-Employer Firms - helps small firms with no employees and with minimal IT complexity use the NIST Cybersecurity Framework (CSF) 2.0 to manage their cybersecurity risks.
- Brilliant at the Basics – created to help small, mid-sized, and non-traditional companies confidently secure their networks, protect sensitive DoW information, and deliver peace through technical strength.
U.S. Department of War (DoW) Chief Information Officer (CIO) - From SMBs for SMBs, Cybersecurity Tips for Small and Medium Sized Business - The Cyber Readiness Institute (CRI) asked its Small Business Advisory Council, a group of 15 public and private organizations that serve SMBs in various capacities, to identify key tips to help SMBs become more secure and resilient. The Council developed the following seven fundamental cybersecurity actions.
Cyber Readiness Institute
Content outlined on the Small Business Cybersecurity Corner webpages contains documents and resources from our contributors. These resources were identified by our contributors as information they deemed most relevant and timely—and were chosen based on the current needs of the small business community. Certain commercial entities may be identified in this Web site or linked Web sites. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.