For business owners

Add a second lock to admin and finance accounts

Turn on passkeys or security keys for the accounts that run your business: email administration, banking and payroll. They can't be captured by a fake sign-in page.

Put passkeys or security keys on admin and finance accounts

Passkeys and hardware security keys work only on the real website, so a fake sign-in page can't capture them. CISA calls phishing-resistant sign-in the gold standard and urges system administrators and other high-value targets to move to it.

• Start with the email admin account, then everyone who can approve payments or reach the bank, payroll or accounting system.
• Most hosted email services already support security keys, so they are a good place to begin.
• Where an app offers only codes, use an authenticator app over text messages.

Remove connected apps you don't use

An app you once allowed into your email or files keeps that access until you remove it. Microsoft notes that resetting a password or requiring MFA doesn't cut off an app that already has permission.

• Once a quarter, list the apps connected to your email and file accounts, and remove any you don't recognize or no longer use.
• Google Workspace admins can review apps under API controls in the Admin console, and mark each one trusted, limited or blocked.
• Microsoft 365 users can review and revoke their own app access at myapps.microsoft.com; admins can review every user's apps in the Microsoft Entra admin center.
• Be wary of any 'connect your account' prompt you didn't expect.

Keep a simple inventory

When a security warning comes out, you can only act on it if you know whether it affects you. CISA's Cyber Essentials guide for small businesses advises keeping inventories of hardware and software.

• One spreadsheet is enough: each computer and phone, the software and websites you rely on, your outside vendors, and who has admin rights to each.
• Remove admin rights from anyone who no longer needs them, and retire devices and software that no longer get updates.
• Update the list whenever someone joins, leaves or changes role.

Patch first what attackers are already using

CISA keeps a public list of software flaws known to be exploited in real attacks, the Known Exploited Vulnerabilities catalog, and advises organizations to use it when deciding what to fix first.

• Turn on automatic updates wherever you can.
• Check new entries in the catalog against your inventory. Anything that matches, especially a system reachable from the internet, gets updated first.
• If you can't update something, ask the vendor what to do, or take it off the internet until you can.

Protect your email domain

Three settings on your domain, SPF, DKIM and DMARC, help receiving mail servers tell whether a message using your name really came from you. If you don't have the technical knowledge, the FTC suggests choosing an email provider that can set them up for you.

• Ask your email or web host to publish SPF and DKIM for your domain.
• Then add DMARC. Start with the setting that takes no action, confirm your real mail passes, then tighten it so failing messages go to spam or are rejected.

Confirm payment changes by phone

If an email asks you to pay a new bank account, call the person on a number you already have before you pay.

Confirm payment changes by phone

Criminals send emails, sometimes from a real but hijacked account, asking you to pay a new account. The FTC suggests requiring staff to call and confirm wire requests received by email.

• Call a phone number you already have on file. Never use the number in the email.
• Require two people to approve large payments and any change to a vendor's bank details.
• If money has already gone, call your bank at once and ask it to recall the payment, then report it at ic3.gov. The FBI says time matters.

Keep one backup offline, and test it

Keep one copy of your important files on a drive you unplug, and check now and then that you can open it.

Keep one backup offline, and test it

CISA warns that many ransomware strains look for backups they can reach and delete or encrypt them. A copy that is disconnected is much harder to reach.

• Back up important files and systems automatically.
• Keep at least one encrypted copy offline or disconnected from your network, including from any shared network drive.
• Restore a file from backup on a set schedule, so you know it works before you need it.

Write down what may go into AI tools

Each AI tool's own terms decide what happens to what you type into it. A short written rule lets staff use these tools without guessing.

• Name the AI tools staff may use, and the account type for each, such as a business plan rather than a personal one.
• Read each tool's terms on whether it keeps or trains on what you enter.
• List what never goes in: client and employee personal details, account numbers, passwords and keys.

When a vendor reports a breach, change what you stored there

A password, API key or access token you gave a vendor may be exposed in its breach, even if your own systems were untouched. The FTC advises limiting vendor access to what they need, for only as long as they need it.

• Change every password, key and token you stored with that vendor or gave it.
• Where something depends on the old key, set up the new one first, switch over, then revoke the old one.
• Check the vendor's access to your accounts for anything unusual, and remove access it no longer needs.

Keep a one-page incident plan

In a crisis, people lose time looking for numbers and deciding who is in charge. CISA advises having an incident response plan, keeping a hard copy, and practicing it.

• List phone numbers for your bank, your IT help, your insurer and your lawyer.
• Name who decides: to shut a system down, to call the bank, and to tell clients.
• Agree how staff will reach each other if email is down, such as a phone tree.
• Note where to report: CISA for cyber incidents, and ic3.gov for crimes.
• Walk through it once a year.