5 simple but important cybersecurity steps for small and medium-sized business owners

The five simple steps that protect a small or medium-sized company are: strong passwords with two-step verification, limited access to data, control over personal devices, trained employees and a plan for the day the company is attacked. None of them requires a big budget.

The news mostly covers security breaches at corporations and institutions, but many of the companies that get attacked are small and medium-sized. Why does this happen? Because small companies generally have neither the staff nor the budget for complex security solutions, and attackers know it.

If hackers can break into huge corporations, with all the attention those pay to cybersecurity, what’s stopping them from attacking smaller companies that can’t afford the same level of protection? The good news for small and medium-sized companies is that proper IT security isn’t out of reach. Here are some cybersecurity tips that any small business owner can benefit from.

IT plans: tell me more →

1. Use strong passwords and two-step verification

Passwords protect the company’s email, accounts and network, but only if they follow a few strict rules.

A strong password is hard to guess, both for people and for computer programs. The recommendations have changed since 2021: the authentication guidelines from NIST (the US standards institute), updated in 2025, require passwords of at least 15 characters when the password is the account’s only protection, and at least 8 characters when it’s used together with a second factor. Length matters more than a mandatory mix of digits and symbols: a passphrase made up of several words is both secure and easy to remember. Strong passwords don’t contain dictionary words on their own or parts of the user’s name, and they’re never used for more than one account.

The same guidelines say passwords shouldn’t be changed periodically, only when there are signs they’ve been compromised. On the other hand, it’s worth having a rule for sharing passwords, even with coworkers.

What to do in practice:

• turn on two-step verification for email, administrator accounts and remote access; it’s the most effective low-cost measure there is;
• use a password manager for the whole team, instead of passwords written on paper or sent in messages;
• where the service allows it, use passkeys instead of passwords.

You’ll find more in our article with basic rules for creating secure passwords.

2. Limit access

Layered security can help keep your most sensitive data safe, even if your system is breached. This means limiting access to certain types of information and adding layers of protection, such as two-step verification, encryption and so on.

In practice: each employee has access only to the data they need, nobody works day to day with an administrator account, and the accounts of people who leave the company are closed the same day. For our clients, we set up the computers and accounts for new hires and close the access of those who leave.

Backup as a Service: tell me more →

3. Control personal devices

As a small or medium-sized company, you may not have the budget to give your employees laptops, tablets and phones. In other words, your employees may be using personal devices to access company data.

If that’s the case, create a written policy: devices that access company data have automatic updates turned on, a screen locked with a PIN or password, and a security solution. With a mobile device management (MDM) solution, such as Microsoft Intune, the company can enforce these rules and remotely wipe only the company data from a lost phone, without touching personal photos or messages.

You don’t need to invade your employees’ privacy or ban certain programs and apps. Even so, you need to protect your business if a personal device puts the network at risk. Details in our article on personal devices used for work.

IT services for companies: tell me more →

4. Train your employees

Even with technical support staff in place, employees can unintentionally cause breaches if they aren’t properly trained. It’s extremely important for employees to understand how they use company resources and what happens when security rules aren’t followed.

Today’s training focuses on phishing messages, which have become more and more convincing since attackers started writing them with the help of artificial intelligence, and on urgent payment requests that arrive by email or phone, sometimes even in the imitated voice of a boss. The basic rule: any request for a payment or a change of bank account is verified by calling a known number, not the one in the message.

5. Plan what to do if the company is attacked

Work with an experienced IT consultant or your in-house IT staff on a plan for a security breach. Because attacks like these are common, it’s best to prepare for the worst. The bare minimum is a backup (a copy of your data) that helps you get the business back up and running if you lose your data.

The backup must include a copy outside the company network, which a ransomware attack can’t encrypt, and restores must be tested regularly. The plan says who makes the decisions, who you notify (clients, the bank, the authorities) and how you keep working until the systems are back. See also our article on the cyberattack response plan.

What has changed for small and medium-sized companies since 2021?

Besides the five steps, a few things are new since we wrote this article:

• Windows 10 went out of support on October 14, 2025. Compatible computers can move to Windows 11 for free; the others receive security updates only through the paid ESU program, until October 2028 at the latest. See how to upgrade.
• NIS2 applies in Romania too. For medium-sized and large companies in the sectors covered by the NIS2 Directive (transposed into Romanian law by GEO 155/2024), these measures have become legal obligations: two-step verification, backup, training and incident management. The competent authority is DNSC, the Romanian National Cyber Security Directorate.
• Incidents can be reported at any time. Any company can report a cybersecurity incident to DNSC on the single number 1911 or through the PNRISC platform (pnrisc.dnsc.ro).

The full list, with 15 minimum measures based on ENISA, CIS and NIS2 guidance, is on our page about IT security for businesses.

RezolvIT is a managed IT services company in Bucharest, certified to ISO/IEC 27001, that handles IT security, backup and IT support for companies of any size, including those with fewer than 10 employees. We also offer support with NIS2 compliance. We start with a free IT audit, which also gives you the exact price.