Small businesses are rarely breached by elaborate attacks. They’re breached through a reused password, an old account nobody disabled, an email that asks to change bank details, or a backup that turns out not to restore. Before anything sophisticated, we recommend the same five steps to every client.
1. Turn on multi-factor authentication everywhere that matters
Start with email, then banking, remote access, and any system with client or financial data. Use authenticator apps rather than text messages where possible. This single step blocks a large share of account takeovers. See our rollout guide.
2. Clean up accounts and access
List every account in your key systems. Disable former employees, remove shared logins, and make sure each person has only the access their role needs. Separate administrator accounts from everyday ones.
3. Verify payment changes by phone
Adopt one written rule: any change to bank details or any unusual payment request is verified by calling a number you already have on file. It defeats most business email compromise. Our payment fraud guide explains why.
4. Make sure backups restore
Check that important data is backed up, that at least one copy is offline or immutable, and that you’ve actually restored from it recently. Untested backups fail at the worst moment. See our backup guide.
5. Keep things updated
Turn on automatic updates for operating systems and browsers, and put everything else, including printers, routers, and specialized software, on a regular patch schedule.
Then go further
These five steps aren’t a complete security program, but they close the doors attackers use most. After them, a cybersecurity assessment can rank the remaining risks for your business, and for tax professionals, align the controls with a written information security plan.
Written by Syntonyl team. This article is general information, not legal, tax, or financial advice.