Train your team
Teach people how to spot suspicious email, protect customer information, and report a security concern. Write down how business data should be handled.
FOR SMALL BUSINESSES
Security resources
you can use this week.
A starting page for owners and managers. Read the 10-tip guide, then open the government pages behind each habit: training, updates, backups, payments, and what to do if something goes wrong.
General education for business owners. Not legal advice, a certification, or a complete security program.
START WITH THE SOURCE
Official guides written for small businesses
These are public pages from U.S. agencies. Use them to brief a manager or an IT helper. They do not replace advice for your own contracts or state notice rules.
FCC: 10 cyber security tipsThe short list this guide is adapted from, including training, firewalls, Wi-Fi, payments, and backups.fcc.gov ↗
FCC Small Biz Cyber PlannerBuild a custom planning guide from topics such as email, mobile devices, employees, and facility security.fcc.gov ↗
CISA cyber guidanceRole-based steps for an owner, a security lead, and the person who handles the computers.cisa.gov ↗
CISA small-business hubFree fact sheets, training, and tools collected for small and medium businesses.cisa.gov ↗
NIST small-business quick startNIST SP 1300, a short way to begin a cybersecurity program with the Cybersecurity Framework.nist.gov ↗
FTC cybersecurity guidancePlain-language pages on phishing, passwords, vendors, ransomware, and data security.ftc.gov ↗
SBA: strengthen cybersecurityA business-guide overview of training, network protection, and multifactor authentication.sba.gov ↗
Diamond Bright compliance guideWhich common privacy and security rules may belong on your radar, and what evidence to keep.On this site ↗
TEN HABITS
What to put in place, and where to read more
Each item matches the tip sheet. The links go to the agency page that explains that habit.
Keep systems updated
Keep operating systems, browsers, apps, and security software current. Turn on automatic updates where that is practical, and apply security fixes promptly.
Use firewall protection
Turn on and maintain firewalls for the business network and computers, including laptops people use when they are away from the office.
Secure mobile devices
Require a screen lock, device encryption, and software updates. Decide how a lost or stolen phone, tablet, or laptop gets reported.
Back up important data
Back up documents, financial records, and customer data. Protect access to the backups, keep a separate recovery copy, and test that files can be restored.
Control physical access
Protect computers and network equipment from people who should not use them. Give each person a separate account and limit administrator rights.
Protect your Wi-Fi
Use strong Wi-Fi encryption and a unique router administrator password. Keep the router updated and keep guest access separate from business systems.
Protect payment systems
Work with a trusted payment provider and follow their security requirements. Keep payment systems separate from everyday browsing and office use.
Limit access to information
Give people access only to the data and systems their job needs. Review that access and remove it when the role ends.
Strengthen account security
Use long, unique passwords and a password manager. Turn on multifactor authentication wherever it is offered, especially for email and administrator accounts.
IF SOMETHING GOES WRONG
Who to contact, and what to write down
Use a known-safe phone or account. Record the time, what people saw, and which systems are affected. A portal message or a website form is not an emergency dispatch line.
Report to CISAReport a cyber incident to the Cybersecurity and Infrastructure Security Agency.cisa.gov/report ↗
FBI Internet Crime Complaint CenterFile a complaint about internet crime, including business email compromise and ransomware.ic3.gov ↗
FTC data breach response guideHow a business can secure systems, fix gaps, and think through notices.ftc.gov ↗
IdentityTheft.govThe FTC recovery site people can use if their personal information was misused.identitytheft.gov ↗
Call Diamond Bright at (618) 936-8308 or email [email protected] when you want help reviewing what happened. State breach-notice duties depend on the information, the people affected, and the states involved. Have a lawyer review those duties.
WHEN YOU WANT A LOOK AT YOUR OWN SYSTEMS
Use the guides, then check the business.
Diamond Bright can assess a local office or run a remote scan, and clients can fill out a cybersecurity action plan in the portal. A scan or a checklist is not a certification.