Small business security baseline

The Canadian Centre for Cyber Security publishes baseline controls for small and medium organizations. They are short on purpose. The goal is to cover the basics that stop most attacks, not to build a full security program on day one.

This hub turns that list into a 90-day sequence. Do the first 30 days even if nothing else gets done.

A 90-day plan

1. Days 1 to 30: stop the common attacksThese controls address the way most small organizations are actually breached.
   • Turn on multi-factor authentication for email, remote access, and every administrator account.
   • Enable automatic updates for operating systems, browsers, and business applications.
   • Back up important data to a copy that an attacker on your network cannot reach, and test a restore.
   • Make sure every device has current anti-malware and a firewall turned on.
   • List your systems, devices, and the data they hold. You cannot protect what you have not listed.
2. Days 31 to 60: close the gapsMove from basics to configuration and access.
   • Configure devices securely, removing default accounts and unneeded software.
   • Give people the least access they need, and remove access when roles change.
   • Secure mobile devices and the connections people use outside the office.
   • Check that your cloud providers meet your security expectations, and review their certifications.
   • Review your website security, including updates, administrator accounts, and forms.
3. Days 61 to 90: build the habitsControls decay without routines.
   • Write a one-page incident response plan with names, phone numbers, and the first steps.
   • Run security awareness training, and repeat it each year.
   • Protect portable storage media, or ban it.
   • Name an owner for security, even if it is a part of someone’s job, and set a quarterly review.
4. Know your threat and your harmThe baseline asks you to understand what matters most.
   • Decide which systems would hurt most if they were unavailable, altered, or exposed.
   • Name the main threat you face, such as ransomware, fraud, or data theft.
   • Let leadership commit time and budget to the plan, because a baseline without sponsorship stalls.

General information, not legal or professional advice. Official documents change, so confirm details with the linked sources before you act.