What Cybersecurity Does a Small Business Actually Need?

A small business needs six baseline cybersecurity controls: multi-factor authentication (MFA) on every account that supports it, endpoint detection and response (EDR) on every computer, consistent patching of operating systems and applications, backups that are actually tested with real restores, email filtering that stops phishing before it reaches an inbox, and security-awareness training for the people using all of it. Those six controls address how small businesses actually get compromised — stolen passwords, malicious email, and unpatched software — far more often than exotic, headline-grabbing hacking does. Everything beyond the baseline is a matter of tiering up based on your industry, the sensitivity of your data, and what a day of downtime would cost your business.

---

The Baseline Six, One at a Time

1. Multi-factor authentication. The single highest-impact control on this list, and often the cheapest. Attackers don't need to break in when they can log in — credentials get phished, reused across sites, and leaked in breaches you'll never hear about. MFA means a stolen password alone isn't enough. Start with email, banking, payroll, and anything with remote access, then extend it everywhere it's supported.

2. Endpoint detection and response. Traditional antivirus checks files against a list of known bad signatures. EDR watches what's actually happening on the machine — a Word document spawning PowerShell, a process encrypting files in bulk — and can isolate a compromised computer before the problem spreads. For any business where a locked-up computer means lost revenue, EDR has replaced antivirus as the floor, not the ceiling.

3. Patch management. Most exploited vulnerabilities are ones a fix already existed for. The discipline isn't glamorous: operating systems, browsers, and the third-party applications everyone forgets (PDF readers, remote-access tools, that one line-of-business app from 2015) all need updates applied consistently, not whenever someone remembers.

4. Tested backups. Backups are your ransomware insurance policy, and modern ransomware crews know it — they go looking for backups to encrypt or delete before they trigger anything. That's why the checklist item is tested backups: an offsite or immutable copy that can't be reached from a compromised network, and periodic restore tests that prove you can actually get your data back. We break down what an incident really costs in our companion post on what ransomware costs a small business — tested backups are the difference between a bad week and an existential event.

5. Email filtering. Phishing remains the most common way attackers reach small businesses, because it works. Good filtering catches malicious attachments, look-alike domains, and credential-harvesting links before a person ever has to make a judgment call. If you run Microsoft 365, tightening sender controls is one of the fastest wins available — we walked through one approach in our post on building an approved-sender whitelist in Microsoft 365.

6. Security-awareness training. Every control above can be undone by one convincing phone call or one urgent-sounding email from a "vendor." Short, recurring training — ideally with simulated phishing so people practice on harmless examples — turns your staff from the softest target into an early-warning system. This is also the control that insurance carriers and auditors increasingly ask about by name.

If standing all six up sounds like a second full-time job, that's essentially what a managed cybersecurity service is: one provider deploying, monitoring, and maintaining the stack so your team doesn't have to become security specialists.

Baseline, Better, Best: How the Stacks Compare

The six controls scale up rather than change. A five-person office and a fifty-person firm both need MFA and tested backups — the difference is how far each control goes. Here's how we think about the tiers:

Baseline is the floor for any business with a bank account and an email address. Better is where most established small businesses should land. Best is for organizations handling regulated data, wiring money regularly, or operating in industries attackers target on purpose — medical practices, law firms, financial offices, and contractors tied into larger supply chains.

What Actually Drives the Cost

Industry pricing surveys for managed IT and security consistently show the same thing: pricing is built per user or per device, per month, and the spread between a lean stack and a compliance-grade one is wide. Rather than quote a number that won't match your situation, here's what actually moves the needle:

AOP quotes cybersecurity as flat-rate custom pricing: we assess what you have, size the stack to your actual risk, and give you one predictable monthly number instead of a menu of surprise line items. And whatever that number turns out to be, the honest comparison isn't against zero — it's against the cost of the incident the stack prevents.

Sized for Southwest Louisiana

The businesses we protect around Lake Charles aren't Fortune 500 targets, and that's exactly the point — attackers automate, and automation doesn't care about company size or zip code. A medical clinic, an industrial contractor, an accounting office, and a family-run retailer in Southwest Louisiana all face the same phishing emails and credential-stuffing attempts as businesses anywhere else, usually with a much smaller IT budget standing in the way.

There's a local wrinkle worth naming: Gulf Coast businesses already plan around hurricane season, and your data deserves the same discipline as your generator. The backup tier of this checklist is also a continuity plan — offsite copies, tested restores, and a written plan for working when the office can't open are security controls and storm preparation in the same line item. When we design a stack for a Southwest Louisiana business, that dual purpose is built in from the start, not bolted on.

AOP has supported Lake Charles businesses since 1991, and our managed IT and cybersecurity services are built for exactly this profile: small teams, real compliance exposure, and no appetite for surprise invoices.

Frequently Asked Questions