The Small-Business Security Stack: What You Actually Need
Most security advice is written for companies with an IT department. You don’t have one. This is the stack for everyone else — five layers, in priority order, each with a free option. You can stop at any layer and be better off than you were.
A necessary disclaimer first: no stack makes you unhackable. The goal is to stop the cheap, automated attacks that cause the overwhelming majority of small-business incidents, and to make sure one mistake doesn’t end the company.
Layer 1 — MFA on email, then everything
If you do exactly one thing, do this. Business email compromise starts with a stolen password, and multi-factor authentication defeats most password theft outright.
- Start with your email platform (Google Workspace or Microsoft 365) — email resets every other password you own.
- Then banking, then your accounting software, then everything else.
- Use an authenticator app or passkeys rather than SMS codes where you can.
- Cost: $0. MFA is included in the accounts you already pay for.
Layer 2 — A team password manager
The moment two people share a login, you need this. Passwords in chat threads and spreadsheets never rotate and follow ex-employees out the door.
What to look for on the plan you’d actually buy (not the enterprise tier): shared vaults or collections, the ability to remove a person in one step, and MFA on the manager itself.
- Free option: Bitwarden’s free tier covers a solo owner; its Teams plan is one of the cheapest paid options. (Bitwarden has no affiliate program — we recommend it because it’s good.)
- Paid options and our comparison are coming after lab testing completes — we don’t rank products we haven’t run.
Layer 3 — Real backup (sync is not backup)
Google Drive and OneDrive faithfully sync your files — including the encrypted ones ransomware just wrote, and the folder someone deleted. Backup means versioned copies somewhere else: if today’s files are destroyed, you can get yesterday’s back.
- Back up laptops and your cloud data (email, shared drives).
- Follow 3-2-1: three copies, two media, one off-site.
- Then actually restore a file twice a year. An untested backup is a hope, not a plan.
Layer 4 — The offboarding list
Not software — a document. One page per person listing every system they can access. When someone leaves, you work down the list in an hour instead of discovering their active accounts for months. Our access-teardown runbook walks through it step by step.
Layer 5 — Email authentication (SPF, DKIM, DMARC)
Three DNS records that stop criminals from sending email that looks like it came from your domain — to your customers, with your name on it. One-time setup with your email provider’s guide; permanent benefit.
What you can skip (for now)
- A VPN — unless you have a specific office-network or compliance need, most cloud-based small businesses don’t need one. Anyone telling you otherwise is usually selling one.
- A hardware firewall — your router plus updated devices covers a 5-person cloud-first office.
- Enterprise EDR/SIEM/SOC tooling — at 1–25 people without a compliance driver, the layers above return far more per dollar.
Where to start
Take the 10-Minute Security Check — it runs entirely in your browser and turns this article into a prioritized to-do list for your specific situation.