Guides
Vendor Risk Assessment for Small Business: The Questions That Matter
Vendor risk assessment for small business starts with questions, not brochures. Here is exactly what to ask, what to request and what ends the call.
Contributor
Evelyn Collins
Evelyn Collins is the editorial byline assigned to this area. Background, definitions and the interpretation of available information belong to this editorial remit. Subject: Small Business Cybersecurity: cybersecurity, protection, basics. A general description is a starting point, not a substitute for the particulars. This is an editorial pen name used by the publication, not a claim of an independently verified personal identity.
Rules
Small Business Website Security Basics: Beyond Installing HTTPS
Small business website security basics go past HTTPS. These are the failures that cost owners money, why they hide for months, and what prevents them.
Guides
Small Business Physical Security Checklist: Locks, Cameras and Access
A small business physical security checklist for protecting devices, networks, and records, with low-cost locks, access routines, cameras, and when to get help.
Guides
Small Business MFA Setup: A Practical Path Without Lockouts
Small business MFA setup without lockouts: a staged rollout with durations, recovery prerequisites and the failure mode that causes Monday morning lockouts.
Guides
DMARC Setup for Small Business Email: Reduce Spoofing Before It Costs You
DMARC setup for small business takes 4 to 8 weeks, and the blocker is 30 days of clean reports before you move to quarantine. Expect the reject policy last.
Guides
Fraud schemes that hit small businesses and how to train staff to spot them
The fraud schemes that hit US small businesses most often: payment redirection, invoice fraud, payroll impersonation and business email compromise, with scenario training and reporting to the FBI IC3 and FTC.
Rules
Quebec's security safeguard rule: what a small business should document
Quebec's private-sector privacy Act requires reasonable security measures, a named privacy lead and provider contracts. Here is what to write down and which tools the Cyber Centre baseline adds.
Reviews
Before you act on endpoint security reviews
How to read endpoint security reviews: what lab tests, analyst reports and marketplace stars each measure, and the two-week record you keep on your own fleet.
Maintenance
Understanding endpoint security properly
Endpoint security for business laptops and phones: the controls that matter in order, a maintenance rhythm you can keep, and the limits of detection tooling.
Rules
Why a security compliance training programme quietly stops working
Why security training programmes stop working, what the completion figure was hiding in each case, and the change that fixes it without buying anything new.
Features
A working brief on security compliance training comparison
Compare KnowBe4, Proofpoint, Hoxhunt, Arctic Wolf and Curricula by what each platform does, who it suits, and how it prices before you buy security training.
Reviews
Security compliance training controls: general guidance
Security compliance training controls: what HIPAA, PCI DSS, ISO 27001 and CMMC require, the cadence and records to keep, and the checks that show they work.
Reviews
Reading security compliance training with a sceptical eye
Security compliance training does two jobs: habits staff will keep, and records an insurer or customer will ask for. How to design for each separately.
Industry
Cloud security comparison: the parts worth your attention
Cloud arrangements compared by where responsibility sits: hosted software or rented machines, native or added tooling, one provider or several, and what never moves.
Rules
Cloud security: what the experienced already know
Cloud security for a small business: what stays yours when software runs elsewhere, from sharing settings and connected applications to forgotten subscriptions.
Reviews
Where phishing defense actually starts: MFA on email, not training
Phishing defense that does not rely on spotting the message: stronger second factors, mail settings worth changing, blameless reporting, a payment rule.
Maintenance
Best security foundations software 2027: an unranked guide
Best security foundations software 2027, grouped by job, not ranked. Compare functions, fit, and billing models; use trial and contract questions before buying.
Guides
Security foundations: accounts, backups and third parties
Security foundations for a small business: the account risks that matter, the three backup properties that hold up, and the third-party access worth reviewing.
Maintenance
Network security comparison: the architecture forks and the products on each side
A network security comparison by architecture fork, from flat or segmented to VPN or proxy, naming the products on each side and the failure each prevents.
Features
Office network security in five rungs, each with a check that proves it
Five rungs of office network security, from the router you own to no trusted office network, with what each leaves open and the check that proves it.
Rules
Incident response reviews: assess providers before signing
Incident response reviews help small businesses test written commitments, sample reports, tabletop performance, and readiness before signing a provider.
Reviews
Four ways to arrange identity and access compared: local accounts, a password manager, SSO, and provisioning
Four ways to arrange identity and access compared: local accounts, a password manager, SSO, and provisioning. What each fixes, leaves open, and what changing takes.
Guides
What questions should identity and access software have to answer?
Identity and access software judged by five questions it must answer about your own accounts, plus the terms you will meet in quotes, what it will never cover, and whether central control is worth the cost.
Guides
Backup and recovery security: protect backup systems
Backup and recovery security starts with separate credentials, protected copies, key custody, safe media handling, and safe restoration.
Reviews
Backup and recovery setup: nine steps for a small business
Nine steps for setting up backup in a small business: what to protect, how often, where copies live, and the restore test that closes each step.
Maintenance
Understanding incident response alternatives properly
Incident response arrangements for a small business, from a printed page to a retainer: what each buys, what it leaves open, and how to test it in advance.
Guides
Network security setup night: kit, tests and the way back
Run a network security setup as a change window: what to have ready, the test that ends each step, and the rule for rolling back when a test fails.
Guides
Backup and recovery: a grounded overview
Backup that survives ransomware: which threats each copy answers, why retention reaches back months, and what a quarterly restore test proves.
Guides
Business email compromise comparison: what to keep and what to drop
Business email compromise controls compared on how early they act, how each fails, the friction they cost, and which survive a compromised supplier mailbox.
Costs
Business email compromise during a mail migration: what breaks and what to freeze
Business email compromise risk rises during a mail migration. What breaks, the payment freeze to announce, what to run in parallel, and the cutover order.
Rules
A working brief on identity and access alternatives
Identity and access alternatives when the ideal is out of reach: defensible second-best choices, what each one gives up, and the check that recovers it.
Maintenance
Identity and access features that remove a decision, not just inform one
Identity and access features sorted by whether they remove a decision or merely inform one, what each costs in attention, and which to switch on first.
Features
Do identity and access reviews actually work by resource, or by person?
Identity and access reviews scoped to four short lists: who signs them, what to do with unclaimed accounts, and using the same test to judge a product.
Features
Getting incident response right the first time
Incident response for a small firm: the decisions to settle in advance, what the first hour is for, when to call for help, and how to review afterwards.
Industry
Network security for small business: separation, router settings, and quarterly checks
Network security once the perimeter is gone: what to separate from what, the router and remote access settings that matter, and a quarterly set of checks.
Features
Business email compromise: stop payment fraud by phone
Business email compromise: the voice call-back rule that stops payment fraud, plus payee-file controls, detection signals, and first-hours response steps.