Your company security plan: where to start

Once your business has staff, client data, and a handful of software accounts, security stops being a personal habit and becomes a company responsibility. Someone has to decide what gets protected first, who owns it, and what happens when something goes wrong. In a small company, that someone is usually you.

This guide gives you a starting plan you can write in an afternoon. It assumes the personal basics are covered or on the way: strong passwords, a password manager, and two-factor authentication. If they aren't, start there.

Why a plan, and not just a list of tools

Most small-company security problems are not caused by missing software. They come from gaps nobody owned: a former employee who still has access, a backup nobody tested, a shared admin password, a payment request nobody double-checked. A plan forces you to assign those gaps to a person and a date.

It also helps you answer questions you'll start getting from outside: from larger clients, from insurers, and from your own team.

Use the NIST framework as your outline

The NIST Cybersecurity Framework (CSF) 2.0 is a free, widely used framework from the US National Institute of Standards and Technology. You don't need to adopt it formally. Its six functions make a good set of headings for a small-company plan:

Function	The question it answers	What it looks like in a small company
Govern	Who is responsible, and what are the rules?	One named owner, a short security policy, a yearly review
Identify	What do we have, and what matters most?	A list of accounts, devices, data, and vendors
Protect	How do we keep it safe?	Two-factor sign-in, updates, encryption, access reviews
Detect	How would we notice a problem?	Sign-in alerts, monitoring, a culture where people report odd things
Respond	What do we do first?	An incident response contact sheet
Recover	How do we get back to normal?	Tested backups and a disaster recovery plan

Govern covers the other five. Review the plan every year and after any incident, and you start the loop again.

Read this as text

Governanswers “Who is responsible, and what are the rules?” It sits across the other five functions rather than being one step among them.

The other five run in order:

Identify: What do we have, and what matters most?
Protect: How do we keep it safe?
Detect: How would we notice a problem?
Respond: What do we do first?
Recover: How do we get back to normal?

After Recover, the loop goes back to Identify: review the plan every year and after any incident.

NIST also publishes small-business quick-start guides for CSF 2.0, which are worth a skim.

Build your plan in five steps

Name an ownerOne person accountable for security decisions
Make an inventoryList accounts, devices, data and vendors
Fix the high-impact controls firstStart with the priority list below
Write down who to callA one-page contact sheet
Put a review on the calendarReview the plan yearly and after changes

Stage 1 of 5: Name an owner

One person is accountable for security decisions and for keeping the plan current. In a company under about 20 people this is usually the owner, an operations lead, or an outside IT partner. "Everyone" is not an owner.

Stage 2 of 5: Make an inventory

List the things an attacker would want or could break:

Accounts: email and productivity suite, banking, payroll, accounting, CRM, website, domain registrar, social media
Devices: every laptop and phone that touches company data, including personal ones
Data: customer records, financial data, contracts, employee files, and where each lives
Vendors: every service that holds your data or can reach your systems

Mark the "crown jewels": the few accounts that would cause the most damage if taken over. Email and the domain registrar are almost always on that list, because they can reset everything else.

Stage 3 of 5: Fix the high-impact controls first

See the priority list below. These are the controls that CISA, the FTC, and cyber insurers keep coming back to.

Stage 4 of 5: Write down who to call

A one-page contact sheet: your IT partner, web developer, bank fraud line, insurer's claims line, and a lawyer. When something goes wrong is the worst time to look these up.

Stage 5 of 5: Put a review on the calendar

Review the plan yearly, whenever someone joins or leaves in a senior role, and after any incident or near miss.

The priority list: what to fix first

If you do nothing else this quarter, do these:

Turn on two-factor authentication everywhere that matters, starting with email, banking, payroll, and admin accounts. Prefer an authenticator app or passkeys over text messages.
Use a company password manager so no one reuses passwords and shared logins can be revoked. See choosing a password manager.
Keep software updated on laptops, phones, browsers, and your website. Turn on automatic updates where you can.
Back up what you can't afford to lose, keep at least one copy that ransomware can't reach, and test a restore. See why backups are your safety net.
Separate admin accounts from everyday accounts. The person who reads email all day shouldn't be signed in as a super admin while doing it.
Verify every payment change by phone, using a number you already have. This one rule stops most business email compromise losses.
Remove access the day someone leaves. Follow security steps when someone leaves.

For a more complete checklist, see your business security checklist.

What to write down

Your plan document can be short. A good template:

Owner and review date
Crown jewels: the five to ten most important accounts and data stores, and who has admin access to each
Required controls: two-factor, password manager, updates, backups, device rules
Vendors that hold sensitive data, with a note on what you've checked (see vendor risk)
Incident contacts and the first steps from your incident response plan
This year's improvements, three to five items with owners and dates

Keep the policy side (what staff must do) in a separate, readable security policy. The plan is for you; the policy is for the team.

Common mistakes

Buying a tool before deciding what problem it solves. Start with the inventory.
Making the plan too long to maintain. A two-page plan you update beats a 40-page binder nobody opens.
Treating it as an IT-only project. Payment fraud, offboarding, and vendor choices are business decisions.
Forgetting personal devices. If staff read company email on their own phones, those phones are in scope. See managing company laptops and phones.
Never testing. A backup you haven't restored, or a contact list with a disconnected number, gives false comfort.

Frequently asked questions

Do I need to hire a security person?

Not at first. Most small companies get far by giving one internal person ownership and using an outside IT provider or advisor for the technical work. As you grow, or once clients start sending security questionnaires, part-time expert help becomes worth it.

Is NIST CSF only for big companies?

No. The framework is voluntary and scales down. NIST publishes small-business resources specifically for it. You can use the six functions as headings without adopting the full framework.

How often should we revisit the plan?

At least once a year, and after any incident, major new system, or change in who holds admin access.