A free guide

Cybersecurity for consultants and solo business owners.

If you are a consultant, a freelancer or the owner of a very small business, you handle security along with everything else. NIST, the US government's standards agency, wrote a guide for exactly that. We rewrote it in plain words, in the order we would do it ourselves, so you can get started this afternoon.

Start with the first three Read NIST's guide ↗

This is adapted from NIST's own guide and it is not a replacement for it. NIST does not endorse this page. It might help you get started much faster. Adapted from NIST CSWP 50, published November 2, 2026.

Read time About 20 minutes to read; the first three steps take most people an afternoon to set up (our estimate)Written for the owner who is also the whole staffUpdated 2026-11-03

01Three things firstthen seven more
02The rules you have to followNIST: Govern
03What your business runs onNIST: Identify
04Lock the doorsNIST: Protect
05Notice when something is wrongNIST: Detect
06When something goes wrongNIST: Respond
07Getting back to normalNIST: Recover
08The words, in plain wordswith examples
09Three businessesNIST's examples, retold
10The four worksheetsprint or download

Three things first

Start with these three, then the rest.

We suggest starting with these three: your email account, the way back into your accounts, and a second copy of your files. If you already suspect an attack, or you have a legal or contract deadline about security, deal with that first. Otherwise these three, then the rest.

Protect your main email account

Done when: The strongest sign-in option your email offers is turned on, ideally a passkey, and you have signed in with it once to see it works.

About 15 minutes, freeHow, step by step ↓2

Make sure you can get back in

Done when: You know how each important account would let you back in, those details are current, and any recovery codes are kept somewhere safe outside the account.

About 20 minutes, freeHow, step by step ↓3

Keep a second copy of your files, and prove it works

Done when: Your important files are copied automatically to something that keeps older versions, a second copy is kept out of reach of your everyday computer, and you have restored one file from each.

About an hour to set up, then a few minutes a weekHow, step by step ↓

Then, over the next couple of weeks, the rest of NIST's short list. Each is one sitting to set up, in our experience; some take longer to finish.

Learn the four checks for a fake message
Use the everyday account on your computer, not the administrator account
Long passphrases and a password manager, so every password is different
Write down what your business runs on (worksheet 1)
Turn on automatic updates on everything
Fill in your who-to-call sheet and print it (worksheet 3)
List the rules you have to follow (worksheet 2)

This is our suggested order, built on the nine priority actions at the front of NIST's guide. We made getting back into your accounts a step of its own, and we start the sign-in step with email before the other accounts. NIST also recommends deciding whether cyber insurance makes sense for you; that is card 3. Times and costs on this page are our estimates, not NIST's.

Why bother, in two minutes

What an attack costs a business of one.

NIST's list of what a security problem can do to a small business reads like a list of what ends one: you cannot work, you lose files, you lose a client's trust, you pay a lawyer or a fine, you cannot get a loan. You are protecting three things.

Kept private

A client's file does not end up in someone else's hands.

Kept correct

Information stays accurate, and an unwanted change to an invoice, a bank account number or a contract can be found and put right.

Kept available

You can get to your files, your email and your store on the morning of a deadline.

These are the three goals NIST starts from. Security people call them confidentiality, integrity and availability, and you will see those words in contracts and insurance forms. They mean private, correct and available.

It can help win work. Bigger clients ask about this before they hire you. Being able to answer puts you ahead of the next bidder.
It is never finished once. Check again every few months and whenever something changes: a new laptop, a new client, a new tool.
You already have help. Your bank, your email provider, your accountant's software and the shop that set up your laptop are part of your security whether you planned it or not. This page tells you what to ask them.

A typical setup

NIST's picture of a one-person business: a laptop, a phone, a Wi-Fi router (the box that connects you to the internet), a printer, an external drive, and a handful of online accounts. NIST names three ways criminals might get in:

The router's factory passwordStill the one it shipped with, which for many models is published in the manual or shared across every unit.
A fake messageAn email, text or social media message that gets you to click, pay or sign in.
An out-of-date website or programOld software with a known hole, which criminals scan for automatically.

Part 1 of 6

The rules you have to follow.

Know what you have promised and what the law expects, and work on it alongside the practical steps rather than after them. Being a business of one does not always mean the rules are simple, but the list is yours to make.

NIST calls this Govern

Write down the rules you have to follow

Done when

Worksheet 2 has a line for every law, license rule, insurance condition and contract clause that says anything about protecting information, with a status, a deadline and a review date.

How

Start with your trade: the bar, the board, the licensing body. Add the card companies' rules if you take card payments, and your insurer's conditions. Then read the contracts you have signed with clients and the companies you rely on for the wording about protecting, using, returning or deleting information, and about telling people when something goes wrong, which often comes with a deadline. If you cannot tell whether a rule applies to you, that is a question for your accountant or lawyer, not a reason to skip the line.

An hour or two with your contracts folder open, more if you have many clients (our estimate) · Worksheet 2

Why

You may be required to do specific things by law or by a contract, and some of those come with deadlines for telling people when something goes wrong. Missing one is a second problem on top of the first.

When you grow

The list of contracts grows with the business and the rules change over time. At some point software that tracks requirements and deadlines earns its keep.

Source: what NIST says

NIST's wording: "Document and track all legal, regulatory, and contractual cybersecurity requirements." (GV.OC-03). NIST CSWP 50.

List the companies you rely on, and agree who protects what

Done when

Every company that holds your information or can reach your systems is on worksheet 1 with what it can get to, what it has promised to do if it has a problem, and how you would hear about it.

How

Your email provider, your bank, the online marketplace, your accountant's software, the person who built your website, your internet company, the online service that holds your files. For each one, write what it can reach and what you would do if it went down for a week. Ask the ones that matter most: what happens to my information if you have a breach, and how will I hear about it? Put the answer on the sheet. When you sign a new agreement, look for the wording about your information before you sign, and check the important ones again every year or so.

Half an hour to start (our estimate) · Worksheet 1

Why

These companies are the backbone of a one-person business, and NIST notes they can also bring in risks of their own. You cannot control them, but you can know what they hold, what they have promised, and what you have agreed to do yourself.

When you grow

The list gets longer with the business. A written way of taking on and reviewing the companies you use, with security terms in contracts and purchase orders, stops the list from getting away from you.

Source: what NIST says

NIST's wording: "Assess the cybersecurity risks posed by suppliers and other third parties." (GV.SC). NIST CSWP 50.

Call your insurance agent

Done when

You know whether your current policy covers a computer or information problem, what it excludes, how much it would pay, what it requires you to have in place, and how fast you must report a problem. The answers are on worksheet 2 and match the written policy.

How

Ask five questions: does my policy cover this kind of problem; what does it exclude; how much would it pay; what does it require of me to keep the coverage (many policies ask for a second sign-in check and backups); and how soon must I tell you if something happens? Ask too whether an addition to your existing policy, or a separate policy, makes sense for what you do. Check the answers against the policy document. Tell your agent when the business changes in a way that matters, such as taking card payments or storing client records.

One phone call · Worksheet 2

Why

Insurance can help you recover from an attack, and some insurers bring experts with them. NIST is clear that it does not replace any of the other steps on this page.

When you grow

More complexity, more to tell the insurer: new services, new systems, new kinds of information. Keep the policy's requirements on your review list.

Source: what NIST says

NIST's wording: "Determine whether cybersecurity insurance is appropriate for the business." (GV.RM). NIST CSWP 50.

Ours The five questions are ours. NIST's action is to decide whether insurance is appropriate and to record the policy's requirements, exclusions, coverage limits and required safeguards.

Part 2 of 6

What your business runs on.

You cannot protect what you have not written down. This is the step we do with much larger organizations through weeks of conversations. You already know your business, so for you it is one worksheet, started in an afternoon and added to over time.

NIST calls this Identify

Write down what your business runs on

Done when

Worksheet 1 lists the devices, programs, online services and kinds of information you could not readily work without, where each one lives, and who else can get to it.
You have a rough sketch of which services pass business information to which.
Business and family devices are separated, or you have a plan to separate them.

How

Start with what you could not work without and add the rest over time. Go round the room and round your phone: the laptop, the phone, the router, the printer, the camera, the external drive. Then the accounts: email, bank, the company that handles your card payments, your store, accounting, the online service that holds your files, social media, the AI tools you use. Then the information: client files, invoices, your customer list, your own designs or writing. Draw a quick sketch of what connects to what, because that is where a problem spreads. Note anything old, unused or duplicated and plan to retire it. Keep work off the family computer if you possibly can.

An hour to start, and it gets easier each time (our estimate) · Worksheet 1

Why

Knowing what you have is what lets you decide what to protect first. The printer and the camera count: anything on your network is a way in.

When you grow

With more devices and people, a list on paper stops keeping up. Software that keeps the list, or the company that looks after your computers, can keep it current for you.

Source: what NIST says

NIST's wording: "Create, categorize, and maintain an inventory of business-critical hardware, software, data, and services (including suppliers and third parties) on which the business relies." (ID.AM-01/02/04/05/06/07). NIST CSWP 50.

Decide what would hurt most, and what is likely

Done when

Every line on worksheet 1 has an answer to what could go wrong, how likely that is in your business, and how bad it would be if the item leaked, were wrong, or were gone. You have picked the first few you will deal with.

How

Use a three-step scale for how bad: an annoyance, a bad week, or could end the business. For each item ask: what could go wrong, how likely is that for me, and what would it cost me if it leaked, if it were changed without my knowing, or if I could not get to it? Then put the likely and serious ones first. A lost phone might be an inconvenience, or serious if it holds client information or is your only way into important accounts. Write what you will do about each one, even if the answer is accept it. If you cannot judge one, that is a question for the person who looks after your computers.

Half an hour once the first list is done (our estimate) · Worksheet 1

Why

This is NIST's idea of risk, scaled down to one person: what could go wrong, how likely, how bad. The point is to spend your limited time on what matters, not on whatever a vendor is selling this week.

When you grow

A growing business keeps this as a running list of problems, actions and review dates, with an owner for each, reviewed on a schedule.

Source: what NIST says

NIST's wording: "Document cybersecurity risks to the business assets." (ID.RA-03/05/06). NIST CSWP 50.

Wipe it before you sell, donate or toss it

Done when

No device leaves you with your information on it, and accounts you stopped using are closed.

How

Follow the maker's instructions for securely erasing that device before trading in, donating or recycling it; most phones and laptops have an erase-everything setting. If the device is broken or you cannot confirm it was erased, get help before it leaves you. Turn on find-my-device now, so a lost or stolen device can be erased from afar the next time it connects. Know how to delete what is in your online services when you no longer need it, and check any record-keeping rules on worksheet 2 before you delete business records. Once a year, close online accounts you no longer use.

Ten to twenty minutes per device (our estimate)

Why

An old laptop sold with your files on it may hand a stranger your passwords, your clients' records and your own work.

When you grow

With more devices, a service that securely erases devices and gives you a certificate.

Source: what NIST says

NIST's wording: "Securely sanitize and destroy data and data storage devices when they are no longer needed." (ID.AM-08). NIST CSWP 50.

Fill in your who-to-call sheet, print it, and try it once

Done when

Worksheet 3 has names and numbers for everyone you would call if something went wrong, the first steps you would take, and the deadlines from worksheet 2 for telling people.
A printed copy is somewhere you can reach without your computer or your email.
You have talked yourself through it once: imagine being locked out of email, and see what the sheet is missing.

How

The shop that looks after your computer, your bank's fraud line, your insurer's claim line, your lawyer, the state police, the FBI field office, your email provider's support, the company where you registered your website name, your password manager's emergency support, your internet company, and the clients you would have to tell. Then write the first steps you would take, in order (there is a starter list on the sheet). Decide now how you would reach people if email were down: a phone list, a second email address. Print it. Then spend ten minutes pretending: your email is locked and the laptop is behaving oddly. Walk the sheet and fix what is missing. Do that again twice a year.

Half an hour, plus ten minutes to try it (our estimate) · Worksheet 3

Why

A prepared and practised plan can help you respond faster and limit the damage. It has to work on a day you cannot think straight and may not be able to open your email.

When you grow

When you hire people or outsource parts of the business, write who does what in a response, and practise it once a year by talking through a made-up incident together.

Source: what NIST says

NIST's wording: "Create a cybersecurity incident response plan." (ID.IM-04). NIST CSWP 50.

Check again every few months, and fix what you learn

Done when

A calendar reminder every quarter to re-read the worksheets, and a habit of noting near misses: the fake invoice you almost paid, the update you kept postponing.
When something happens, a test shows a gap, or something important changes, you update the sheets then, not at the next quarter.

How

Put the reminder in now. At each check: anything new on the list, anything that should come off, any rule that changed, any near miss worth fixing. If you ever get a security check from a client or an insurer, use what it found, and fix anything urgent straight away rather than filing it for later.

Twenty minutes a quarter (our estimate)

Why

NIST says even the smallest business can learn from what nearly went wrong. The threats change, your tools change, and the sheet from last year is wrong in small ways.

When you grow

As the business grows the check becomes more regular and more formal, with results written down and tracked.

Source: what NIST says

NIST's wording: "Strive for continuous improvement." (ID.IM). NIST CSWP 50.

Part 3 of 6

Lock the doors.

These are the settings and habits that reduce the most common attacks on a one-person business. Three of them are the three-first list at the top of this page.

NIST calls this Protect

Turn on the strongest sign-in option every account offers

Done when

Email, banking, the company that handles your card payments, the online service that holds your files, your password manager, your store, social media and the company that holds your website name all have their strongest sign-in option turned on, and you have signed in once with each to see it works.
Wherever a passkey or security key is offered, you use it instead of a code by text message.

How

Start with email, because many other accounts reset their passwords through it. In each account's security settings look for two-step verification, two-factor authentication or passkeys. Choose a passkey if it is offered: you sign in with your fingerprint, face or device code instead of a password, and a fake website cannot use it. Next best is an app that generates sign-in codes, then a code by text. Note how each account would let you back in; that is the next card. Then do the bank, card payments, your files, the password manager, the store, social media, the website name. Worksheet 4 tracks which are done.

About 15 minutes for email, an evening for the rest, free (our estimate) · Worksheet 4

Why

A password alone leaves an account exposed, especially if it has been stolen or reused somewhere else. NIST calls stronger sign-in protection one of the most important steps a business can take. It makes a stolen password much less useful; it does not stop every kind of account theft.

When you grow

Anyone you give access to, staff or contractor, uses the strongest sign-in option on every account that offers it. Single sign-on, where one login opens everything, becomes worth it once there are several people.

Source: what NIST says

NIST's wording: "Enable multifactor authentication (MFA) on all accounts that offer it and consider using password managers to generate and protect strong, unique passwords." (PR.AA-03). NIST CSWP 50.

Stronger sign-in, in plain words

Some accounts let you sign in with your device and your fingerprint, face or device code instead of a password; that is a passkey, and a small key you plug in works the same way. Other accounts add a check after your password: a code from an app, a tap on your phone, a code by text. NIST describes these as something you know, something you have, and something you are, and asks for two of them. Any of these makes a stolen password much less useful. None prevents every kind of account theft. They are not all equal: a code sent by text can be tricked out of you by a fake website; a passkey or a security key cannot, because it only works on the real site and nothing is typed that can be stolen. So the order of preference is passkey or security key, then an app that generates codes, then a code by text, then nothing. NIST calls the first kind phishing-resistant.

Source: NIST CSWP 50, Multi-Factor Authentication box, section 3.3

Make sure you can get back into your own accounts

Done when

For each important account you know which ways back in it offers (a recovery phone, a backup email address, one-time codes) and those details are current.
Any recovery codes are kept somewhere safe outside the account they recover, such as with the printed who-to-call sheet in a locked drawer.
You know how your password manager would let you back in, and you have decided whether to let a trusted person use its emergency access.

How

In each account's security settings, find the recovery options and check that the phone number and backup email are yours and current. If the account gave you one-time recovery codes when you turned on the stronger sign-in, print them and keep them somewhere safe and separate. Read your password manager's own recovery instructions; many offer emergency access, which lets a person you choose get in after a waiting period. That is a real decision, because it gives them everything, so make it on purpose. Then imagine losing your phone today: can you still get into email, the bank and the password manager? If not, fix that now.

About 20 minutes, free (our estimate) · Worksheet 4

Why

Stronger sign-in locks criminals out. Done without a way back in, it can lock you out too, on the day your phone is stolen. NIST's worksheet asks for the recovery details of every account for this reason.

When you grow

Recovery for shared and business-owned accounts is written down and known to more than one person.

Source: what NIST says

Based on NIST: NIST's worksheets record an account recovery email or phone for every account (Table 1 and Appendix J), and NIST asks for a printed or offline copy of important contacts (ID.IM-04). Making recovery its own step, and the advice about recovery codes and emergency access, is ours. (PR.AA-03, ID.IM-04). NIST CSWP 50.

Ours NIST lists recovery details as a column on its worksheets. We made it its own step because it is where one-person businesses get stuck.

Long passphrases and a password manager

Done when

Every account that still needs a password has a different one of at least 15 characters.
An app that makes and remembers passwords for you (a password manager) holds them, protected by one long passphrase and the strongest sign-in option it offers.

How

Pick a password manager: your browser has a basic one built in, and separate ones add features such as sharing and emergency access. Give it one long passphrase you can remember, four or five unrelated words. Then let it generate and remember a different password for every account, starting with the ones on worksheet 4. Use passkeys wherever they are offered so there is no password to steal at all.

An evening of changing passwords; free, or a few dollars a month for a separate app (our estimate) · Worksheet 4

Why

NIST's guidance is that length matters more than complexity: at least 15 characters, and never the same one twice. NIST suggests a password manager to make that practical.

When you grow

A business password manager with shared folders, so people get the logins they need without a spreadsheet of passwords.

Source: what NIST says

Based on NIST: NIST's front-page priorities: use strong and unique passphrases of at least 15 characters, consider a password manager, and avoid passwords where possible by using passkeys (section 1.1), with the password manager advice repeated in PR.AA-03. (PR.AA-03, section 1.1). NIST CSWP 50.

Use the everyday account on your computer, not the administrator account

Done when

You do your daily work from an account set to Standard, and keep the Administrator account for changing settings and installing programs.
Anyone else who uses the computer has their own account with no access to your work.

How

On Windows and Mac the account you set the computer up with is usually the Administrator, the one that can change anything. Make a second account set to Standard and use that for everything. When something needs installing, the computer will ask for the administrator password, which is the point. If family shares the computer, each person gets their own Standard account. For online accounts, give nobody more access than they need for as long as they need it, and look at who has access twice a year.

About ten minutes (our estimate)

Why

NIST calls this the principle of least privilege: the less an account can do, the less harm a bad click can do through it. A Standard account limits what harmful software can change. It does not stop every infection.

When you grow

Written rules for what access people get when they join, change jobs and leave, including contractors when a contract ends.

Source: what NIST says

NIST's wording: "Limit access to sensitive assets to only those who require it to perform their job responsibilities." (PR.AA-05). NIST CSWP 50.

Change the passwords your router and other devices came with

Done when

The password for changing your router's settings and the password for joining its Wi-Fi are both your own, and worksheet 4 says so for every device that came with a password.

How

The router first. Sign in to it with the details the maker supplied (often on a sticker underneath), change the password for its settings, change the Wi-Fi password too (they are two different things), and turn on automatic updates if it has them. Then the printer, cameras, smart speakers and anything else that came with a password. Write each one on the second table of worksheet 4.

About half an hour (our estimate) · Worksheet 4

Why

NIST notes that many devices arrive with a password that is easily found or already known to criminals, because it is shared across many units or printed in the manual. A device still using it can let someone change its settings or get onto your network.

When you grow

A routine for setting up any new device so the factory password never survives the first day.

Source: what NIST says

NIST's wording: "Change default manufacturer passwords." (PR.AA-01). NIST CSWP 50.

Install updates, automatically where you can

Done when

Automatic updates are on for the laptop, the phone, the browser and the router.
Once a month you check everything else on worksheet 1 that cannot update itself: the printer, cameras, your website's software, the programs you installed by hand.
Nothing you use has stopped getting security fixes from its maker.

How

Turn on automatic updates in the settings of the computer, the phone, the browser and the router. Once a month, go down worksheet 1 and check the things that update less reliably: accounting and design programs, the printer and cameras, the software behind your website. Look up whether the maker still supports each device and program; if not, plan to replace it, because it will no longer get security fixes.

Twenty minutes to set up, ten a month (our estimate)

Why

Out-of-date software has known holes, and criminals scan the internet for them automatically. Updates close the holes.

When you grow

A tool that pushes updates to every computer and reports what is missing.

Source: what NIST says

NIST's wording: "Regularly update and patch software and operating systems." (PR.PS-02). NIST CSWP 50.

Learn what attacks look like, and the everyday habits

Done when

You can name the four checks for a fake message without looking, you know how you would report a suspicious message, and you have taken a short security course in the last year.

How

Read the fake messages box below and keep the four checks somewhere you will see them. Once a year take a free course that covers fake messages, reporting suspicious activity and everyday security habits: NIST's small business page lists them, and many trade groups run their own. Decide where you would report a fake message (your email provider's report button, the company being impersonated, the FBI's reporting site). Share the four checks with anyone who handles money or email for you, including family.

An hour a year (our estimate)

Why

Fake messages are how most ransomware and most payment fraud start. NIST treats knowing what they look like, and the everyday habits, as a protection in its own right.

When you grow

Regular training for everyone you hire, and a simple way for them to report a suspicious message to you.

Source: what NIST says

NIST's wording: "Recognize common attacks and perform basic cyber hygiene tasks." (PR.AT-01/02). NIST CSWP 50.

Fake messages: the four checks

A fake message is an email, text or social media message that tries to get you to click a link, open a file, pay something, change a bank account or sign in somewhere. AI has made them convincing, so NIST's rule is simple: anything that asks you to act gets a second or third look.

Slow down when it is urgent. Urgency is the tool. Stop and think, even when the message looks real and comes from a name you know.
Check the sender's real address. Your bank does not write from a free webmail account. Look at the address, not the display name.
Never confirm through the message itself. Do not click the link or call the number in the message. Use the contact details you already had, or the company's own website.
Treat money and sign-in requests as suspect until confirmed. New bank details on an invoice, an urgent payment, gift cards, a password reset: call the person on a number you already had before you do anything.

Source: NIST CSWP 50, section 3.3.1, Protect Your Business from Phishing

Keep a second copy of your files, and prove you can get them back

Done when

Your important files are copied automatically to a backup service or drive that keeps older versions, and you have checked which files it actually covers.
A second copy is kept where an attacker on your everyday computer could not reach it: a drive you disconnect after each copy, or a separate backup service protected by its own strong sign-in.
You have restored one file from each copy in the last three months.

How

Turn on the backup your computer and phone offer, then check what it really does: which folders it copies, how long it keeps deleted files and older versions, and how you would get them back. A service that keeps folders matching across your devices will copy a mistake or a locked file just as faithfully, so make sure it keeps older versions you can go back to. For the second copy, buy an external drive, copy the files you could not work without, disconnect it, and repeat on a schedule that matches how much work you could stand to lose, weekly for most people. Include what lives only in online services, such as an export of your customer list. Protect the backup account with the strongest sign-in it offers. Then restore one file from each copy and put a reminder in your calendar to do it again next quarter.

About an hour to set up, then a few minutes a week; an external drive is a modest one-time cost (our estimate)

Why

If the laptop is stolen or breaks, or criminals lock your files, a tested backup is how you get your work back without redoing it. A backup you have never tested is a guess. A backup that an attacker on your computer can reach, change or delete may be damaged along with everything else, which is why NIST suggests at least one copy kept apart.

When you grow

A backup service that covers every computer, and a note of who checks it and when.

Source: what NIST says

NIST's wording: "Regularly back up data. Establish measures to protect and test backups." (PR.DS-11). NIST CSWP 50.

Ours The cloud-plus-disconnected-drive arrangement and the weekly schedule are our suggestion. NIST asks for regular backups, more than one copy with at least one not connected to the device or in the cloud, periodic restore tests, and a check of what your providers keep.

If criminals lock your files

Ransomware is when criminals lock your files and charge you to unlock them. It reaches online accounts too, not only the laptop. NIST lists ten basic preventive steps. We suggest starting with these three, then working through the others, with technical help where you need it.

Three things first

A backup kept out of reach of your everyday computer, and that you have tested.
Working from the everyday (Standard) account, with the stronger sign-in on.
Installing updates when they appear.

Also do

Do not open attachments or links you were not expecting, and let your protection software scan anything you must open.
Keep the software that checks for harmful programs on and let it update and scan on its own, including email attachments and USB drives.
Keep the who-to-call sheet current, with the police, your lawyer and whoever would help you respond.
Ask your insurance agent whether your policy covers this kind of attack.

When you grow, or if you have an IT person

Set the computer to run only programs you have approved. Ask the person who looks after your computer whether yours can do this.
Turn on the setting that slows down or locks out repeated wrong passwords.
Use a service that blocks known-bad websites and addresses, and protect your website name from being faked.

Source: NIST CSWP 50, section 3.3.2, Protect Your Business from Ransomware (ten steps, all kept here; the grouping is ours)

Part 4 of 6

Notice when something is wrong.

You will not be watching screens all day. You can set things up so that the important alerts come to you, keep the records that show what happened, and look up from the desk now and then.

NIST calls this Detect

Turn on the alerts, and keep the records

Done when

Software that checks for harmful programs is on and updating itself.
New sign-in notices, bank and card transaction alerts, and notices of changes to your website name are switched on and go to an address you read.
Where an account or device offers a record of activity (sign-in history, a log), it is turned on.

How

Use the protection built into your computer, or a paid product, and let it update and scan on its own. In each important account turn on notifications for new sign-ins from unknown devices, and turn on the activity record or sign-in history if there is one; it can show what happened later. Turn on transaction alerts at the bank and with the company that handles your card payments. At the company where you registered your website name, turn on change notices and the lock that stops the name being moved. Read password-reset emails you did not ask for as a warning, not as spam.

About half an hour (our estimate)

Why

Alerts can help you notice some problems sooner and limit the damage: a sign-in from a country you have never visited, a payment you did not make, a password reset you did not request. NIST also suggests turning on activity records where they exist, because they help work out what happened.

When you grow

A service that watches your computers around the clock, or an all-in-one security product that watches and reacts for you.

Source: what NIST says

NIST's wording: "Continuously monitor assets to find indicators of attacks or compromises." (DE.CM). NIST CSWP 50.

Look around the room

Done when

Devices lock themselves after a few minutes, paper files are in a locked drawer, and find-my-device and erase-from-afar are on for the laptop and the phone.

How

Turn on automatic screen lock on every device. Lock the drawer with the client files. Think about where you actually work: the café, the co-working space, the car. Do not leave the laptop in the car. Turn on find-my-device and the option to erase it from afar. Notice anything odd: a lock that looks forced, a device moved, a USB stick you did not plug in.

About fifteen minutes (our estimate)

Why

NIST points out that security is not only online. A stolen laptop may expose the client information on it; a screen lock helps, and the device's own encryption helps more, but neither settles it on its own.

When you grow

An office with controlled entry, cameras, or a building with a front desk.

Source: what NIST says

NIST's wording: "Assess the physical environment for signs of tampering or suspicious activity." (DE.CM-02). NIST CSWP 50.

Part 5 of 6

When something goes wrong.

The who-to-call sheet you printed earlier is the plan. What you do first depends on what is happening: a device behaving oddly, an account taken over, or money on the move. These three cards and worksheet 3 use the same order.

NIST calls this Respond

Stop it spreading: disconnect, stop using it, secure the accounts

First steps done when

If a device may be infected, it is off the Wi-Fi and off the network cable, still switched on unless the person helping you says otherwise, and you have stopped using it.
If an account may have been taken over, you have changed its password from a device you trust and ended every other sign-in to it.
If money is being moved or asked for, you have called the bank's fraud line.

How

If a device may be infected: turn off its Wi-Fi or unplug the network cable, leave the power on, and stop using it, including for changing passwords. If an account may be in someone else's hands: from another device you trust, change the password, end all other sign-ins (the account's security page lists devices and apps still signed in), and check for settings that send copies of your email elsewhere. If money is being stolen or you have been asked to pay: call the bank's fraud line before anything else. Then follow the sheet. Let the person who looks after your computer, or your protection software, do the technical part.

The first few minutes · Worksheet 3

Why

NIST's first aim in a response is to keep the problem from spreading. Using a compromised computer to fix things can give the criminal your new passwords too.

When you grow

Software that isolates an infected computer automatically, so containment does not depend on who is in the office.

Source: what NIST says

NIST's wording: "Contain incidents." (RS.MI-01). NIST CSWP 50.

Ours The three branches (device, account, money) are our way of ordering NIST's possible containment steps, which it lists as examples rather than one fixed procedure.

Follow your sheet and write everything down

First steps done when

You have the printed sheet in hand, you have called the first helper on it, and you are keeping notes of what you saw, when, and what you have done.
With help, you have saved whatever records exist: the suspicious message itself, screenshots, the account's sign-in history.

How

Get the printed sheet. Start a note, on paper if need be: what you noticed, the time, screenshots if you can take them safely, and every step you take from now on. Call the first helper on the sheet, usually the shop that looks after your computer or your insurer's line, and ask them to help you keep the records that show what happened. Decide how you keep working in the meantime: paper invoices, phone calls, a spare laptop, the second email address you set up when you made the sheet.

The first hour · Worksheet 3

Why

A plan made in advance and followed calmly can help you respond faster and limit the damage. The notes and records matter for the insurer, the bank, the police and for working out afterwards what happened.

When you grow

More people involved, each with a written part, and a practice run once a year.

Source: what NIST says

NIST's wording: "Execute the incident response plan in coordination with relevant third parties." (RS.MA-01). NIST CSWP 50.

Tell the people you have to tell, by their deadlines

Done when

You have used worksheet 2, and your lawyer where needed, to work out who must be told, what to say and by when, and you have a note of what you reported and when.

How

Worksheet 2 has the deadlines: the insurer (often within days), the bank, a regulator if your trade has one, clients whose information was involved, and in some cases the people whose personal information was affected. Follow the order and deadlines on your sheet; if money is being stolen or transferred, the bank comes first. Do not miss a reporting deadline while waiting to know everything. Ask your lawyer to look at anything you send to clients.

Depends on the rules; the deadlines are on the sheet · Worksheet 2

Why

NIST notes that some rules and contracts set a clock for telling people about a confirmed incident. Missing it adds a legal problem to a technical one.

When you grow

Communications get harder as there are more people to tell. Larger organizations bring in someone who does this for a living.

Source: what NIST says

NIST's wording: "Communicate with internal and external stakeholders on response activities, as required by laws, regulations, or policies." (RS.CO). NIST CSWP 50.

Part 6 of 6

Getting back to normal.

Recovery is slower than people expect, and the mistakes made in a hurry are the expensive ones. Three cards.

NIST calls this Recover

Restore carefully

Done when

Before restoring, the person helping you has checked both the backup and the device you are restoring to.
Before you trust any account again, you have reviewed who can get into it (including users you did not add), devices and apps still signed in, what is shared with whom, settings that forward your email elsewhere, and the sign-in protection.

How

Before restoring, have the person helping you check that the copy you are restoring from is clean and that the device you are restoring to is clean too, or you will bring the harmful software back. Before using an account again, open its security settings: is anyone there you did not add, is anything still signed in that is not yours, is anything shared with someone you do not know, is there a setting sending copies of your email elsewhere, is the stronger sign-in still on? Fix each one before you trust the account.

Hours to days

Why

Criminals leave doors open on the way out: a setting that copies your email to them, a device still signed in, a user you never added. Restoring the files without checking the doors starts the whole thing again.

When you grow

The same checks, done by more people across more systems, from a written recovery plan.

Source: what NIST says

NIST's wording: "Execute the recovery portion of the incident response plan." (RC.RP-01). NIST CSWP 50.

Keep people informed while you recover

Done when

The clients, companies and insurer you told at the start hear from you during the recovery, you have met any required notifications, and they know when normal service is back and what changed.

How

A short, plain note to each person you told earlier, while you are recovering and again when you are done: what happened, what you did, what is different now. Let your lawyer see it first if clients' information was involved; some contracts require a formal notice.

An hour or two

Why

NIST calls regular communication critical to recovery. It is also how trust survives, and some contracts require it.

When you grow

Larger organizations use a communications professional for this.

Source: what NIST says

NIST's wording: "Coordinate restoration activities with internal and external parties." (RC.CO). NIST CSWP 50.

Write down what you learned

Done when

One page: what happened, how you responded and recovered, and what you will change, with dates. And the changes are on your next check.

How

Write it while it is fresh. What was the first sign, how did they get in, what you did to respond and to recover, what worked, what did not, what you will change. Then change the worksheets to match.

An hour

Why

Use what you learned to reduce the chance, and the impact, of another incident.

When you grow

A review with everyone involved of what happened and what to change, and the changes tracked to completion.

Source: what NIST says

NIST's wording: "Document lessons learned from the incident." (RC.RP-06). NIST CSWP 50.

The words

What the jargon means, in plain words.

The words you will meet in contracts, insurance forms, vendor emails and NIST's guide, and what they mean on this page. Open a row for an example.

The things your business runs onAsset
For example: Your laptop, your phone, your email, your online store, your customer list, the Wi-Fi router, the accounting software. NIST includes information, people and services in the word, so your accountant's software and your own know-how count too.
Kept private, kept correct, kept availableConfidentiality, integrity, availability
For example: A client file leaks (private). An invoice amount is changed (correct). Your files are locked on a deadline morning (available). These are the three goals NIST starts from.
How likely something is to go wrong, and how much it would hurtRisk
For example: For each thing that could go wrong, ask how likely it is in your business and what it would cost you. A lost phone might be an inconvenience, or serious if it holds client information or is your only way into important accounts.
What could go wrong, and the weak spot that lets itThreat and vulnerability
For example: A fake invoice asks you to pay a criminal; that is the threat. Paying changed bank details without checking them with a person you know is the weak spot. Calling that person first closes it.
A second check when you sign inMulti-factor authentication (MFA)
For example: After your password, the bank app asks you to tap Approve on your phone, or to type a six-digit code from an app.
A sign-in that a fake website cannot usePhishing-resistant MFA, passkey
For example: A passkey: you sign in with your fingerprint, face or device code, and it only works on the real website. A security key you plug in works the same way.
Fake messages that try to get you to click, pay or sign inPhishing
For example: "Your account will be closed today, sign in here." "Here is the updated bank account for your supplier's invoice." A text from "the post office" about a parcel you are not expecting.
Criminals lock your files and charge you to unlock themRansomware
For example: You open a file and ten minutes later every document shows a note demanding payment. Files kept matching in an online service can be locked too.
Use the everyday account, not the administrator accountLeast privilege, administrator account
For example: Your computer's administrator account can change anything. A second account set to Standard, used for everyday work, limits what a bad click can do. It does not stop every infection.
Install updatesPatch, update
For example: The "update available" notice on your laptop, phone, browser and router. Say yes, or set it to automatic.
Something goes wrongIncident
For example: Your email sends messages you did not write. Your online store shows someone else's products. Your laptop is stolen from the car.
Your who-to-call sheet and what to do firstIncident response plan
For example: A printed page: take the device off the internet, call your IT person, call the bank, tell the clients whose files were on it, keep notes.
Stop it spreadingContainment
For example: Turn off the Wi-Fi on the laptop, leave it on, do not use it to reset passwords, end the account's other sign-ins from a device you trust.
The companies and people you rely onThird parties, suppliers, service providers
For example: Your email provider, your bank, the online marketplace, your accountant's software, the person who built your website, your internet company.
The rules you have to follow, and the choices you make about riskGovernance, requirements
For example: Your state bar's client confidentiality rules, the card companies' rules for taking payments, the privacy clause in a client contract, a tax record retention law, and your own decision about which risks to accept.
Check again every few monthsContinuous improvement
For example: A calendar reminder: go back over the worksheets every quarter and after anything changes, such as a new laptop, a new client or a new tool.
Alerts, sign-in notices and activity recordsLogging, monitoring
For example: The "new sign-in from an unknown device" email, bank transaction alerts, the password-reset message you did not ask for, and the account's sign-in history.
Wipe it before you sell, donate or toss itSanitize, dispose
For example: Use the phone's erase-everything setting before trading it in, following the maker's instructions. Close the account you stopped using.
The company you pay to look after your computersManaged service provider (MSP, MSSP)
For example: The local IT shop that set up your laptop, or the service that watches your computers for a monthly fee.
A second copy of your files kept somewhere elseBackup
For example: A copy in a backup service that keeps older versions, plus a copy on a drive you keep disconnected, and you have tried getting one file back from each.
The spare key to your accountRecovery information
For example: The backup phone number, the recovery email, the one-time codes you were given when you set up the stronger sign-in.
Files or services held by an online company rather than only on your deviceCloud
For example: Your email, your online store, the service that keeps your files matching across your laptop and phone.
NIST's six headings for security workCybersecurity Framework (CSF) 2.0
For example: Govern, Identify, Protect, Detect, Respond, Recover. On this page they are the rules you follow, what you run on, lock the doors, notice when something is wrong, when something goes wrong, and getting back to normal.

Three more things NIST wants you to know

Privacy, AI, and when to get help.

Privacy is not the same as security

You can keep a customer's information perfectly safe and still misuse it, for example by keeping it for years after you needed it. NIST offers three starting habits, not a complete privacy program: know how personal information is collected, used, shared, stored and deleted in your business; collect, share and keep it only for the business purposes the customer would expect; and check the privacy settings on the tools you use so they match what you intend.

Source: NIST CSWP 50, section 1.8

AI tools

If you use AI to write, to answer customers, to automate work or to help with code, NIST suggests these starting precautions: list the AI tools you use, including features switched on inside software you already had, and turn off the ones you should not be using; write down the rules that apply to using AI in your trade; before you enter anything sensitive, check whether the service keeps it, uses it to train its systems, or lets others see it; review everything it produces before you use it; and ask the companies you rely on what AI they run on your information.

NIST's guide says "super intelligence" where this page says AI, because a September 29, 2026 executive order told federal agencies to use that term. It means the same tools.

Source: NIST CSWP 50, section 1.9

When to get help, and from whom

Most people reading this page do not need a consultancy like ours, and we would rather say so. For technical work, choose someone who can show experience with businesses your size and the rules of your trade; the shop that supplied your computer may or may not be that. NIST's advice: decide what you want done before you shop; get referrals and quotes from more than one provider (we suggest three); ask how they work with businesses your size and with the rules of your trade; put the service in writing; and remember the responsibility for your business stays with you. NIST keeps a finder for free and low-cost small business security programs run by non-profits around the country.

Source: NIST CSWP 50, section 1.7 · NIST's Small Business Cybersecurity Corner

Three businesses, three bad days

What it looks like when it is you.

NIST's workbook walks three imaginary one-person businesses through every action in its guide. Here they are, condensed, with the decisions each owner made and the event NIST uses to test them.

The lawyer

An intellectual property attorney who helps other small businesses protect their patents, trademarks and trade secrets, working from a co-working space.

The decisions

Started with the bar's rules on client confidentiality and wrote them on the requirements sheet, with each client contract's wording about information beside them.
Bought cyber insurance because client files are the business, and recorded what the policy requires.
Listed every company relied on, ranked them by how much the practice depends on them, and asked each what happens to client information if they are breached.
Hired a company to watch the computers around the clock, because one person cannot.
Turned on a passkey or a security key everywhere, bought a password manager, set everything to update itself, and backs up client files continuously with a copy kept offline.
Checks the co-working space for tampered locks and moved devices, and never leaves a device out.

The day it was tested. Ransomware locks the computer. The first call is to the monitoring company. The lawyer takes the computer off the network, leaves it on, does not touch it, and goes back to the requirements sheet to see which clients and which authorities must be told, and how fast. Afterwards the lawyer and the monitoring company write up what happened and what will change.

The maker

Someone who has just started selling made-to-order hats on a popular online marketplace, from a workshop at home.

The decisions

Keeps every signed agreement, including the marketplace's terms, in one binder with a table of contents of what each one requires.
Asked the insurance broker about adding cyber cover to the existing business policy, and the insurer's own templates became the who-to-call sheet.
Wrote down which companies can reach the store and the customer information, and what each one holds.
Bought a laptop used only for the business, which nobody else touches, and uses the everyday account on it.
Chose a backup service that scrambles the stored files so only the maker can read them, and checks now and then that a restore works.
Keeps a log of the USB sticks used between workshops, and wipes them when they are retired.
Blocks one hour a month to go over the sheets and check that updates really installed.

The day it was tested. The marketplace itself is knocked offline by an attack on it, and the store disappears with it. The maker switches off the store's connections to other tools, signs out of it everywhere, talks to the marketplace's support and to the insurer, and keeps customers informed by email and social media. When the marketplace comes back, nothing of the maker's was touched. The lesson written down: the business had never considered what it would do if the marketplace was simply unavailable, and now it has a plan.

The consultant

A marketing and sales consultant working with clients large and small around the world on branding and plans for bringing products to market, with an AI assistant in daily use.

The decisions

Reads each client contract for what it says about handling the client's information, including what the client allows the AI assistant to see.
Bought insurance because the business runs on clients' marketing and sales information.
Pays a local company to look after IT and keeps client files in an online service rather than on personal devices.
Listed the laptop, phone, printer and router, the software on each, and every online account.
Wrote down the biggest risks: ransomware on a personal device that also holds client information, and one client's files reaching another client while working on shared documents.
Agreed with each client, in writing, how their information is handled and when it is deleted.
Set the protection software to isolate the computer automatically if it finds something.

The day it was tested. The consultant's weak spot is one many people share: backups to an online service are on, but a restore has never been tested. That is written on the improvement list, with a date, before anything goes wrong.

Condensed from Appendices D, E and F of NIST CSWP 50, which walk each business through all 22 actions; the events and decisions are NIST's, the wording is ours. The originals are in NIST's workbook, linked at the bottom of this page.

The worksheets

Four sheets, one afternoon.

Four sheets, in the order you will need them. Print one, or download it as a spreadsheet and fill it in on your own computer. The worksheets do not send anything to us; what you write stays in your printout or your downloaded file.

1What my business runs on, and what would hurt most

NIST Appendix H, Calculating, Documenting, Categorizing, and Prioritizing Cybersecurity Assets and Risks Worksheet

One line per thing the business depends on. The three "how bad" columns use the three-step scale: an annoyance, a bad week, could end the business. The example rows are made up; replace them with your own.

What is it?	Where does it live? (office, phone, online service)	Who else can get to it?	Anything needing special protection? (client secrets, personal details, card details)	What could go wrong, and how likely? (rare, possible, likely)	If it leaked, how bad?	If it were wrong, how bad?	If it were gone, how bad?	What will I do about it?	Backed up? (checked how?)	Strongest sign-in on?	Way back in? (recovery phone, email, codes)
Work laptop	Office and travel	Nobody	Client files	Theft or loss: possible	Bad week	Annoyance	Bad week	Standard account, screen lock, backup, find-my-device	Yes: service keeps versions, plus a drive; restore tested in March	Does not apply	Does not apply
Email account	Online service	Nobody	Client messages	Account taken over: possible	Could end the business	Bad week	Could end the business	Passkey, recovery details checked	Not checked yet: confirm what the provider keeps	Yes, passkey	Yes
Customer list and invoices	Accounting software, online	Accountant	Personal details, bank details	Leak through the software provider: rare	Could end the business	Bad week	Bad week	Stronger sign-in on, ask accountant about their security	Yes: export monthly to the backup drive	Yes, app code	Yes
Online store	Marketplace	Marketplace staff	Customer orders	Marketplace outage: possible	Bad week	Bad week	Bad week	Plan for the marketplace being down	Not checked yet: ask what the marketplace keeps	Yes	Yes
Wi-Fi router	Office	Visitors on the Wi-Fi	Nothing stored	Factory password still set: likely until changed	Annoyance	Bad week	Annoyance	Change both passwords, auto-update	Does not apply	Does not apply	Does not apply

NIST's columns, if you want them all: identifying information, owner, data sensitivity, location, confidentiality impact, integrity impact, availability impact, estimated impact if compromised, planned risk treatment, treatment owner, backup status, strong unique password, MFA enabled, account recovery email or phone. You remain responsible for everything on this list; note in the "who else" column when another person or company owns or manages an item. NIST's "data sensitivity" is the "special protection" column, and its three impact columns are the three "how bad" questions.

2Rules I have to follow

NIST Appendix G, Document and Track All Legal, Regulatory, and Contractual Cybersecurity Requirements

One line per rule, from the law, your licensing body, the card companies, your insurer, or a contract. The deadline column matters most when something has gone wrong. The example rows are made up.

Who sets the rule?	What does it ask of me?	Am I meeting it? (yes, in progress, no)	Deadline, including how fast I must report a problem	Where is my proof?	How is it checked? (self-check, audit, client review)	What do I still need to do?
State bar (example)	Keep client information confidential; tell clients if it is exposed	In progress	Tell affected clients promptly	This sheet, worksheet 1	Self-check	Finish worksheet 1
Card companies (example)	Protect card details; use the payment company's secure checkout	Yes	Report a suspected breach to the payment company immediately	Payment company's annual questionnaire	Self-assessment
Insurer (example)	Stronger sign-in on email and backups kept	Yes	Report a claim within 72 hours	Policy, worksheet 4	At renewal
Client contract (example)	Delete their files 90 days after the project ends	In progress	Notify within 48 hours of a breach	Contract, page 4	Client review	Set a deletion reminder

3Who I call, and what I do first

NIST Appendix I, Respond and Recover Worksheet

Print this one. Keep it somewhere you can reach without your computer or your email. The first steps are a starting point in the same order as the cards above; change them to fit your business.

Who	Name	Phone	Email or website
The person or shop that looks after my computer
My bank's fraud line
The company that handles my card payments
My insurer's claim line and policy number
My lawyer
State police
FBI field office (fbi.gov/contact-us/field-offices) and the FBI's online reporting site (ic3.gov)
My email provider's support
The company where I registered my website name
My password manager's emergency support
My internet company
Social media support
My accountant
Clients I would have to tell (list them)
How I reach people if my email is down (second address, phone list)

The first steps I take

If money is being moved or someone is asking me to pay: call the bank's fraud line first.
If a device may be infected: take it off the Wi-Fi and the network cable, leave it switched on, stop using it.
If an account may be in someone else's hands: from a device I trust, change its password, end its other sign-ins, and check for settings that forward my email.
Call the first helper on this sheet. Start a note: what I saw, when, what I have done. Keep the suspicious message and any screenshots.
Check worksheet 2 for who must be told and how fast. Decide how I keep working today: paper, phone, a spare laptop, my second email address.

4Where the stronger sign-in is on, and which factory passwords I changed

NIST Appendix J, Authentication Worksheet

Two short tables. The first is your accounts, most important first. The second is every device that came with a password.

Account	Stronger sign-in on?	What kind? (passkey, security key, app code, text code)	Passkey or security key? (the kind a fake website cannot use)	Way back in saved? (recovery phone, email, printed codes)	Notes
Email
Bank
Accounting and tax
The company that handles my card payments
Password manager
The online service that holds my files
Online store or website
The company where I registered my website name
Customer list or CRM
Social media

Devices that came with a password

Device	Settings password changed?	Wi-Fi password changed? (router only)	Updates on automatically?
Wi-Fi router
Printer		Does not apply
Security camera		Does not apply
Smart speaker or other smart device		Does not apply
External drive or network storage		Does not apply

The same order we use with much larger organizations

Three steps, no meetings.

When we work with a bank or a hospital, the first three steps are the same as on this page: agree how risk is judged, list what the business runs on, then decide what would hurt most. There it takes weeks of conversations with every part of the business. For you it is a three-step scale, worksheet 1 and an afternoon to start, because you already know your business. The order matters more than the size.

Decide how you judge a problem

An annoyance, a bad week, or could end the business. A simple starting method; more sensitive work or contract duties may need help.

Write down what your business runs on

Worksheet 1 asks the questions we would ask a client. You answer them yourself.

Decide what to fix first

The likely and serious ones, then the rest. Then the doors, the alerts, the bad day and the day after.

Monthly update by email

Get next month's update the day it's out.

One email a month. The stories that matter most, what they mean for your risk, and the questions to ask your team. Unsubscribe in one click.

Where this comes from

Adapted from NIST Cybersecurity White Paper 50, Small Business Cybersecurity: Non-Employer Firms, by Daniel Eliot, Jeffrey Marron and Savann Thorn, published November 2, 2026. NIST does not endorse this adaptation, and this page is not a replacement for NIST's guide; it might help you get started much faster. We have reorganized NIST's guidance into our own order and added plain-language examples, suggested routines, and our estimates of time and cost. The "Source" note on each card separates NIST's recommendation from what we added. NIST publications are works of the United States government and are not subject to copyright in the United States.

Last checked against NIST's publication on 2026-11-03. Spotted a mistake? Use the form below.

Cybersecurity for consultants and solo business owners.

Start with these three, then the rest.

Protect your main email account

Make sure you can get back in

Keep a second copy of your files, and prove it works

What an attack costs a business of one.

The rules you have to follow.

Write down the rules you have to follow

List the companies you rely on, and agree who protects what

Call your insurance agent

What your business runs on.

Write down what your business runs on

Decide what would hurt most, and what is likely

Wipe it before you sell, donate or toss it

Fill in your who-to-call sheet, print it, and try it once

Check again every few months, and fix what you learn

Lock the doors.

Turn on the strongest sign-in option every account offers

Stronger sign-in, in plain words

Make sure you can get back into your own accounts

Long passphrases and a password manager

Use the everyday account on your computer, not the administrator account

Change the passwords your router and other devices came with

Install updates, automatically where you can

Learn what attacks look like, and the everyday habits

Fake messages: the four checks

Keep a second copy of your files, and prove you can get them back

If criminals lock your files

Notice when something is wrong.

Turn on the alerts, and keep the records

Look around the room

When something goes wrong.

Stop it spreading: disconnect, stop using it, secure the accounts

Follow your sheet and write everything down

Tell the people you have to tell, by their deadlines

Getting back to normal.

Restore carefully

Keep people informed while you recover

Write down what you learned

What the jargon means, in plain words.

Privacy, AI, and when to get help.

Privacy is not the same as security

AI tools

When to get help, and from whom

What it looks like when it is you.

The lawyer

The maker

The consultant

Four sheets, one afternoon.

1What my business runs on, and what would hurt most

2Rules I have to follow

3Who I call, and what I do first

The first steps I take

4Where the stronger sign-in is on, and which factory passwords I changed

Devices that came with a password

Three steps, no meetings.

Get next month's update the day it's out.

Run