A practical baseline
Two public guides describe this starting point without selling a product. CISA's Cyber Essentials asks a small organization to cover six elements: leadership, staff, systems, who has access, data backups, and crisis response. It tells leaders to begin with backups, multi-factor authentication, and patching. The FTC's Cybersecurity for Small Business guidance says to turn on automatic updates, back up important files, require multi-factor authentication where sensitive work happens, train people on a schedule, and write down what you will do in a breach. The checklist below is that advice, in language a Kansas City firm of this size can run.
Multi-factor authentication
Multi-factor authentication means a password is not enough to sign in. A second step, such as a code in an authenticator app, is required. Turn it on for email, remote access, and every administrator account first, then for the other business apps people use daily. A password manager helps people stop reusing passwords. The two solve different problems, which is why a business needs both. CISA says to start with privileged, administrative, and remote-access users if you cannot turn it on for everyone in one day.
Patching
Patching means installing the security fixes the software maker has already published. Turn on automatic updates for operating systems, browsers, and the apps you rely on, and replace software the maker no longer updates. A laptop or firewall that has sat for a long time without updates is a known door. Put the work on a schedule someone owns, and look at what failed to update.
Endpoint detection and response
Endpoint detection and response, often called EDR, is software on each computer that watches for malicious programs and can cut that computer off from the rest of the business. Ordinary antivirus that only looks for a known bad file is a start, and it is not the whole job. EDR matters because people in a 10–50 person firm work from home, a client office, or a hotel, where the office firewall never sees the laptop. Put it on every company computer, including the ones that leave the building.
Email security
Most trouble still arrives as email: a fake invoice, a fake login page, or a message that looks like it came from the owner. Use filtering that quarantines suspicious mail, and publish SPF, DKIM, and DMARC so other companies can tell real mail from your domain apart from a spoof. The FTC describes those three checks on its small-business cybersecurity page. Our plain-language guide to SPF, DKIM, and DMARC says what each one does. Someone still has to look at the quarantine. A filter nobody reviews does not help.
Backups you have tested
A backup is a copy you can restore, not a green light on a dashboard. The FTC says to back up important files and keep a copy in the cloud or on storage that is not the only copy on the same computer. CISA says backups should run automatically, with protected or offline copies. Test a restore on a schedule: pick a real file or mailbox, bring it back, and write down that it worked. The restore-test checklist is the short version of that habit.
Least privilege
Least privilege means each person, and your IT provider, gets only the access the job needs. Administrators are few. When someone leaves, access ends the same day. A vendor does not keep standing access "just in case." The FTC's vendor guidance says to limit a vendor to the data the work requires, and only for as long as the work takes. CISA says the same about administrator permissions.
Security awareness training
Security awareness training is a short habit you repeat, not a video nobody finishes. The FTC says to train staff on a schedule, including people who work from home, and to tell them what to do if a laptop or a file goes missing. Training does not replace the technical controls above. It supports them. Read what training can and cannot do before you buy a long catalog of courses. Keep a record of who completed it. Insurers often ask for that record.
An incident response plan
An incident response plan is a page or two: who decides, who to call, how you keep working, and how you tell clients if their information was involved. CISA asks leaders to write that plan and to test it. The FTC asks the same thing in different words: know how you will save data, run the business, and notify people. You do not need a binder. You need current names and phone numbers, and a scheduled practice, so the first time anyone reads the plan is not during the incident. A longer walk-through is in what happens when a business gets hacked.
Cyber insurance readiness
Cyber insurance can help pay for investigators, legal advice, client notification, and lost work time. It does not replace the controls above. The FTC says to discuss first-party coverage and third-party coverage with your insurance agent, and to read what a policy actually includes. Applications ask about multi-factor authentication, backups, patching, and training. If the form says yes and the systems say no, the insurer can dispute the claim. Compare the form with the evidence before anyone signs it. More on that is in whether cyber insurance is worth it and whether it will pay. We are an IT provider, not an insurance broker. What a particular policy covers is a question for your licensed adviser and the policy itself.
What is usually overkill for 10–50 people
For most firms of this size, the items below are more than the risk calls for until the baseline is already in place:
- A full-time security team. The work at this size is a managed baseline, not a department.
- Several products that do the same job. Two endpoint tools, or two email filters, mostly create noise and a larger bill.
- A security operations center you staff yourselves around the clock. Alerts still need a person. A firm this size rarely has someone whose only job is watching security alerts overnight.
- Hardware security keys for every employee before multi-factor authentication is on for everyone. Keys are useful for administrators and for people who move money. They are a later step.
- A SOC 2 examination, unless a client or a contract requires a report. SOC 2 is a specific examination of a company's controls. It is not the starting point for a firm that still needs multi-factor authentication on email.
- Penetration tests on a short repeating cycle, such as every month, before patching and backups are reliable. A scheduled test is useful once the basics exist. A calendar full of tests is not a substitute for those basics.
- A custom security program written like a large bank's, with a tool for every line on a poster. CISA and the FTC both describe a starting point, not a maximum.
None of these is wrong for a firm that has a real reason, such as regulated data or a contract that will not close without it. They are the wrong first purchase.
How to prioritize on a budget
Spend in this order. Stop when the money runs out, and do not skip ahead because a product demo looked impressive.
- Multi-factor authentication on email, remote access, and administrator accounts.
- Automatic updates, and a person who checks what did not update.
- Endpoint detection and response on every company computer.
- Email filtering, plus SPF, DKIM, and DMARC.
- Backups, and one restore test you can show someone.
- Least privilege: fewer administrators, and access removed when people leave.
- Short security awareness training on a schedule, with a record of who attended.
- A one-page incident response plan, and one scheduled practice.
- A cyber insurance application filled out from that evidence, then reviewed with your broker.
If a client questionnaire or an insurer asks for something further down the list, do that item next. Otherwise an unfinished item near the top is a better use of the next dollar than a new product category. Compass plan scope is on the pricing page. This article does not repeat prices, because those figures live in the pricing feed and change there.
Where Blue Tree Technology® fits
Blue Tree Technology® supports Kansas City firms that want this baseline in place. We monitor systems 24/7. The help desk is available Monday–Friday, 8 AM–6 PM Central. Overnight monitoring is not a promise that a person answers the phone at 2 AM. Ask any provider, including us, what happens to an alert outside help-desk hours.
The GTIA Cybersecurity Trustmark is an independent assessment for IT providers. Blue Tree Technology® is in the process of earning it. We have not been awarded it. We also do not claim a SOC 2 report. A Trustmark, even after that review is finished, does not replace the nine items above on your own systems. Read where the Trustmark stands and what SOC 2 is before you compare providers by badges alone.
To put the list in order for your firm, start with cybersecurity services or schedule a free 15-minute discovery call. A related buying question, what a managed cybersecurity service includes, is covered in what security a small business needs and whether IT support is enough.
Sources
- CISA, Cyber Essentials. The six elements of a culture of cyber readiness, and the three actions the guide says to take first: back up data, require multi-factor authentication, and patch and update software.
- FTC, Cybersecurity for Small Business. Basics for updates, backups, multi-factor authentication, staff training, incident planning, email authentication, vendors, and cyber insurance, plus a pointer to the voluntary NIST Cybersecurity Framework.
The practices named above come from those two guides. This page does not add incident counts or loss figures.
FAQ
Is antivirus enough for a firm of this size?
No. Antivirus looks for known bad software. You still need multi-factor authentication, updates, email protection, and backups you have restored at least once. Endpoint detection and response is the usual next step on the computers themselves.
What should we fix first on a tight budget?
Multi-factor authentication on email and on administrator accounts, then updates, then a backup you have actually restored. Those are the three actions CISA tells leaders to start with.
Can cyber insurance replace these controls?
No. The FTC describes cyber insurance as help paying for losses after an attack. It does not describe a policy as a replacement for updates, backups, multi-factor authentication, or training.
Do we need a SOC 2 report at 10–50 people?
Usually no, unless a client or a contract asks for one. Finish the baseline first. Blue Tree Technology® does not claim a SOC 2 report.
Has Blue Tree Technology® earned the GTIA Cybersecurity Trustmark?
Not yet. The Trustmark is in progress. We will say so on the Trustmark page when it is awarded. Until then, ask to see the certificate from any provider that claims it.
Will someone from the help desk answer at 2 AM?
Monitoring runs 24/7. The help desk is available Monday–Friday, 8 AM–6 PM Central. That is not a round-the-clock response promise. Ask what happens to an alert outside those hours, and keep the incident plan where a manager can find it at night.
Related Blue Tree Technology® pages
- Cybersecurity services
- Compass plans and pricing
- Is cyber insurance worth it, and will it actually pay?
- What security does a small business need, and is IT support enough?
Still have a question?
Ask Little Sprout, the assistant on our website, for general information. To talk through which of these nine items you already have, schedule a free 15-minute discovery call.