Cybersecurity is a team effort
People are sometimes described as the "weakest link" in cybersecurity. That description is too simple.
Cyberattacks can exploit many parts of a business, including employee accounts, devices, applications, networks, cloud services, vendors, and poorly protected data. People can play an important role, but technology and security processes matter too.
For small and medium-sized businesses, the goal should not be to find one weak link. It should be to build layers of protection that make it harder for an attacker to succeed and easier for your organization to detect, respond to, and recover from an incident.
The NIST Cybersecurity Framework 2.0 provides a risk-based approach that small businesses can use to organize cybersecurity around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Here are five areas to prioritize as part of that strategy.
1. Train your employees
Your employees interact with business systems and information every day. They receive email, access applications, handle customer information, use company devices, and may work remotely.
That makes cybersecurity awareness an important part of your overall security program.
Regular training can help employees recognize:
- Phishing and social engineering
- Suspicious links and attachments
- Impersonation and business email compromise
- Unexpected requests for payments or sensitive information
- Unsafe use of removable storage
- Unusual account or device activity
- Security risks when working remotely
Training should also explain what employees should do when something goes wrong.
For example, if an employee clicks a suspicious link, loses a company laptop, or accidentally sends sensitive information to the wrong person, they should know how to report the incident quickly.
The FTC recommends regular employee training and specifically advises businesses to teach staff how to recognize common attacks and perform basic cybersecurity practices.
Make security part of everyday work
Annual training can be useful, but cybersecurity awareness should not be a once-a-year activity.
Consider using:
- Short security reminders
- New-employee security training
- Phishing awareness exercises
- Regular policy updates
- Incident reporting procedures
- Periodic security reviews
The objective is not to make employees afraid of making mistakes. It is to give them the knowledge and tools they need to recognize problems and respond appropriately.
2. Secure every endpoint
A business laptop isn't just a productivity tool. It is also a potential entry point into company systems and data.
The same is true for:
- Desktop computers
- Smartphones
- Tablets
- Printers
- Network equipment
- Storage devices
- Point-of-sale systems
- Other connected devices
Before adding a device to your business environment, consider its security capabilities and how it will be managed.
Keep devices updated
Software, operating systems, applications, and firmware can contain vulnerabilities. Updates frequently include security fixes, so businesses should have a process for keeping connected devices current.
The FTC recommends regularly updating security software and other software, including on devices that connect to the business network.
Protect devices when they are lost or stolen
Laptops and mobile devices can contain sensitive information or provide access to business accounts.
Use appropriate protections such as:
- Screen locks
- Device encryption
- Strong authentication
- Remote management
- Remote lock or wipe capabilities when available
- Physical security
- Current backups
Security should be considered when purchasing technology, not added as an afterthought.
3. Strengthen passwords and authentication
Passwords still play a role in cybersecurity, but passwords alone are not enough to protect important business accounts.
NIST notes that passwords are not phishing-resistant and recommends stronger authentication approaches where practical.
Use multi-factor authentication
Multi-factor authentication, or MFA, requires users to provide additional evidence of their identity beyond a password.
Depending on the service, that could include:
- An authentication app
- A hardware security key
- A passkey
- A biometric factor used with an appropriate authenticator
- Another approved authentication method
The FTC recommends requiring MFA for employees, contractors, and others who access business networks and devices.
For particularly sensitive accounts, consider phishing-resistant authentication where supported.
Use unique passwords
Employees should not reuse the same password across business and personal accounts.
A password manager can help employees create and securely store unique passwords without requiring them to memorize dozens of credentials.
Don't force arbitrary password changes
Older security advice often recommended requiring employees to change passwords every 60 or 90 days.
Current NIST guidance takes a different approach. Organizations should not require passwords to be changed periodically without a reason. Instead, a password should be changed when there is evidence that it has been compromised or when another specific security requirement calls for it.
Strong, unique passwords combined with MFA are generally more useful than forcing employees through frequent password resets.
4. Control who can access business information
Not every employee needs access to every system or file.
Limiting access can reduce the potential impact of a compromised account or accidental disclosure.
Start by asking:
- Who needs access to this system?
- What information does each person need?
- Are administrative privileges necessary?
- Are former employees still listed as users?
- Are contractor accounts still active?
- When was the last access review?
Use the principle of least privilege: give users the access they need to perform their responsibilities and avoid unnecessary permissions.
The FTC recommends restricting access to sensitive information to people who need it to perform their jobs.
Don't overlook administrative accounts
Administrator accounts can make extensive changes to systems and security settings.
Where practical, separate everyday user accounts from administrative accounts and protect privileged accounts with stronger authentication and additional controls.
5. Protect your data and prepare for recovery
Even strong preventative controls cannot eliminate every cybersecurity risk.
A business should also plan for what happens if an attacker gets through.
Back up important data
Maintain backups of critical business information and make sure those backups are protected from unauthorized access.
Your backup strategy should account for information such as:
- Financial records
- Customer information
- Business documents
- Databases
- Operational data
- Important configuration information
The FTC recommends regularly backing up data as part of a small-business cybersecurity program.
Test your backups
A backup that cannot be restored when you need it is not much help.
Periodically test your recovery process and verify that important information can actually be restored.
Create an incident response plan
Decide ahead of time what your business will do if:
- An employee clicks a phishing link
- A device is lost or stolen
- An account is compromised
- Malware is detected
- Business data is encrypted by ransomware
- A vendor experiences a security incident
- Sensitive information is accidentally exposed
Identify who employees should contact and what steps should happen next.
The FTC recommends that small businesses create an incident response plan covering issues such as protecting data, maintaining business operations, and communicating with affected customers when necessary.
Think beyond the five weakest links
Cybersecurity works best as a system.
Instead of asking, "How do I stop employees from being the weakest link?" ask:
Where could an attacker enter, what could they access, and how can we limit the damage?
Consider the major layers of your environment:
| Security layer | Questions to ask |
|---|---|
| People | Do employees know how to recognize and report threats? |
| Identity | Are important accounts protected with MFA? |
| Devices | Are endpoints managed, updated, and protected? |
| Applications | Are business applications maintained and securely configured? |
| Network | Is business traffic appropriately protected and segmented? |
| Data | Is sensitive information appropriately classified, protected, and backed up? |
| Vendors | Do third parties have appropriate security requirements? |
| Recovery | Can the business recover from a security incident? |
This layered approach aligns with the broader risk-management model in NIST CSF 2.0.
What about printers and other connected devices?
Printers and multifunction devices can handle sensitive documents and connect directly to business networks, so they should be included in your security planning.
Consider controls such as:
- Access authentication
- Secure configuration
- Firmware updates
- Encryption where supported
- Network segmentation
- Secure release or pull printing
- Automatic deletion of stored print jobs when appropriate
- Monitoring and logging
Pull printing, sometimes called secure release printing, requires a user to authenticate before a document is released from a printer. This can reduce the chance of sensitive documents being left unattended in a printer tray.
The broader lesson is simple: any device that connects to your business environment should be considered part of your security strategy.
Make cybersecurity everyone's responsibility
Employees are not the enemy, and technology is not a complete solution.
A strong cybersecurity program gives people the tools and processes they need to make safer decisions while using technology that provides additional layers of protection.
Start with the fundamentals:
- Train employees regularly.
- Protect and update endpoints.
- Use MFA and strong authentication.
- Limit access to sensitive systems and information.
- Back up critical data.
- Prepare an incident response plan.
- Review your security practices regularly.
For businesses that need a structured starting point, NIST's Cybersecurity Framework 2.0 includes a Small Business Quick-Start Guide designed specifically for organizations with modest or no existing cybersecurity plans.
Frequently asked questions about business cybersecurity
Are employees really the weakest link in cybersecurity?
Not necessarily. People can make mistakes that create security risks, but cyberattacks can also exploit vulnerabilities in software, devices, accounts, networks, vendors, and business processes. A layered security strategy addresses all of these areas.
What is the most important cybersecurity practice for a small business?
There is no single control that protects a business from every threat. Start with fundamentals such as MFA, regular software updates, employee training, access controls, protected backups, and an incident response plan.
Should employees change their passwords every 90 days?
Not automatically. Current NIST guidance says organizations should not require arbitrary periodic password changes. Passwords should be changed when there is evidence of compromise or another specific security reason.
Is MFA better than a password alone?
MFA provides an additional authentication factor beyond a password and can significantly improve account protection. NIST and the FTC both recommend MFA as an important part of small-business security.
Should small businesses secure printers too?
Yes. Printers and multifunction devices can store or transmit business information and connect to company networks. They should be included in endpoint security, access-control, update, and data-protection policies.
What should employees do if they think they made a security mistake?
Report it immediately according to the company's incident-response procedure. Fast reporting can give security teams more time to contain an incident and reduce its impact.
Strengthen every layer of your cybersecurity
There is no single "weakest link" that explains every cybersecurity incident.
Your employees, devices, identities, applications, networks, data, and vendors all play a role in your security posture. Protecting one area while ignoring another can leave an opening for attackers.
A stronger approach is to build layers of protection and continuously improve them.
Train your people. Protect your technology. Secure your identities. Limit access. Protect your data. And prepare to recover.
That's how businesses can build a cybersecurity strategy that is stronger than any single link.
