Protect What You’ve Built: Practical Cybersecurity Steps for Small Businesses

As you take stock of what your team has accomplished and look ahead to the holiday season, consider how you’re protecting that progress.

The customer relationships, employee information, and everyday systems your business depends on deserve attention year-round.

Cybersecurity is a business risk, even if someone else manages your technology. A compromised email account can expose payroll information, redirect a vendor payment, or interrupt service to customers. In 2024, the FBI received reports of more than $2.7 billion in losses from business email compromise, scams that use fake or compromised email accounts to trick people into sending money or sensitive information. Small businesses aren’t immune to these threats.

You don’t need to tackle everything at once. Start with the systems and decisions that matter most to keeping your business running.

---

1. Make Safe Decisions Easier for Your Team

Give employees clear guidance on handling sensitive information, using approved tools, and reporting anything unusual. Short reminders during onboarding and team meetings can keep those expectations familiar.

Walk through situations your team might realistically face: an invoice with new banking details, a payroll-change request, or an urgent message that appears to come from you. Before acting, confirm unusual requests through a known phone number or another trusted channel. For example, if a vendor emails new payment instructions, call them using the number already in your records, not the number in the email, to confirm the change before sending money.

AI tools can help scammers write convincing emails and imitate a familiar voice, making fraudulent requests harder to spot. A message may sound like you or a trusted vendor, without the spelling mistakes employees were once taught to watch for. Remind your team that polished wording or a familiar-sounding voice doesn’t verify who’s behind a request. The same confirmation process should apply, especially before moving money or sharing sensitive information.

Make it clear that checking is welcome, even when the request seems urgent. Thank people for speaking up, including when they report their own mistake. Early reporting gives you more time to respond.

---

2. Strengthen Access to Your Most Important Systems

Start with email, payroll, banking, and customer records. Ask your technology provider to help you confirm these basics:

• Use unique, strong passwords and a business password manager.
• Require multifactor authentication, which adds verification beyond a password. Use phishing-resistant options, such as security keys or passkeys, where supported.
• Give people access only to what they need, and remove accounts or permissions when roles or vendor relationships change.
• Keep devices and software updated, using automatic security updates where practical, and retire devices and software that no longer receive updates.

For a clearer picture of your current cybersecurity gaps, work through the checklist with whoever supports your systems, then assign someone to follow up on the items you identify.

---

3. Know How You’ll Keep Operating

If your email or scheduling system went down tomorrow, what work would stop first? Identify your critical systems and ask how each is backed up, how those backups are protected from an attack, and when restoration was last tested. A backup completion notice alone doesn’t tell you whether you can recover the information you need.

Keep a short response plan with contacts for technology support, leadership, and your insurance provider. Keep a copy accessible outside company email, such as a printed copy or a secure personal-device copy. Include who can authorize urgent decisions and how you’ll communicate if normal channels are unavailable.

Once the plan is in place, walk through one realistic scenario with your team, such as a compromised email account, to identify missing contacts or unclear responsibilities.

Start by asking what your business would need to keep serving customers if a cyberattack took a key system offline. That conversation can help you spot gaps in your response plan and understand where cyber insurance fits—and what your policy may not cover.

— Gary St. John, VP, Risk Management

---

4. Understand What Your Insurance Actually Covers

Cyber insurance can help with recovery, but what it covers depends on the specific policy and its terms. Don’t assume your general business insurance covers a cyber incident, or that every cyber policy covers the same losses.

Ask your advisor:

• What help and coverage are available for incident response, data recovery, and business interruption?
• What security practices, notification requirements, or approvals does the policy require, and what happens if they aren’t met?
• What responsibilities remain with your business versus outside providers?

If you use OneDigital’s PEO, you are covered by a Cyber Liability Program.  Coverage includes breach restoration, certification expenses, extortion expenses, along with other coverages. In addition, the PEO Client has access to a Security Resources Center to review and access any potential cyber gaps that currently exist.

---

Choose One Useful Step

Protecting what you’ve built is also a way of caring for the people who helped build it. Start with one manageable action: verify payment-change procedures, check multifactor authentication, or review your recovery contacts. Assign an owner and agree on how you’ll confirm it’s done.

If you’d like help understanding your exposures and coverage, connect with our team today about practical next steps for your business.

---

Frequently Asked Employer Questions

1. What cybersecurity steps should a small business prioritize?

Start with employee awareness, unique passwords, multifactor authentication, software updates, and tested backups. Prioritize systems holding financial or sensitive information, and make sure everyone knows how to report a concern. Then review your cyber coverage with your advisor so you understand how it responds if something goes wrong.

2. Does business insurance cover cyberattacks and payment fraud?

Not necessarily. Cyber incidents and fraudulent payments may require specific coverage or endorsements. Ask your advisor to explain applicable exclusions, limits, and conditions rather than assuming your current policies respond to both.  OneDigital’s PEO Clients’ are covered subject to policy terms and conditions.

3. What should employees do if they click a suspicious link?

Stop interacting with the message and report it immediately through your established process. Tell your technology support contact whether you entered information or downloaded anything. Follow their instructions, preserve the message, and avoid trying to investigate or fix the issue on your own.