A Six-Part Cybersecurity Plan for Your Online Business

A password policy is no longer a sufficient center of gravity for an online business’s security strategy. The 2026 Verizon breach findings say software vulnerabilities initiated 31% of breaches, overtaking stolen passwords as the leading entry route, while ransomware appeared in 48% of breaches.

The practical response is not to discard identity controls, but to place them inside a broader operating plan. The current NIST framework for small businesses organizes that plan around six functions: Govern, Identify, Protect, Detect, Respond and Recover.

Begin with business consequences, not security products

A useful strategy starts by deciding what the business cannot afford to lose or leave unavailable. For an online retailer, that may be the storefront, payment workflow and order records; for a consultancy, it may be client files, email and cloud collaboration accounts. This ranking determines where limited time and money should go first.

Assign one person to own the plan, even if technical work is outsourced. That owner should record the company’s risk tolerance, applicable contractual or regulatory duties, essential services and the people authorized to make decisions during an incident. A managed provider can operate tools, but the business still owns decisions about acceptable downtime, sensitive data and customer communication.

Governance should also cover suppliers. Hosting companies, payment processors, contractors, plugins and software-as-a-service platforms can reach business data or affect operations, so contracts and onboarding decisions should address access, security responsibilities, incident notification and removal of access when the relationship ends.

Build an inventory that answers four questions

You cannot protect an account, device or integration that nobody remembers exists. Create a compact inventory and maintain it as an operational record rather than a one-time spreadsheet exercise. For each important asset, answer four questions:

What hardware, software, cloud service, domain, repository or data set does the business depend on?
Who owns it internally, who administers it and which employees or contractors can reach it?
What sensitive information does it contain, and how long does the business genuinely need that information?
What would happen to sales, service delivery or legal obligations if it were altered, exposed or unavailable?

Include less obvious dependencies: domain registrar accounts, DNS hosting, social media administration, automated marketing tools, API keys and integrations authorized through single sign-on. Record software versions where the business controls updates, and identify unsupported devices or applications that need replacement.

Then remove what has no continuing purpose. Delete obsolete accounts, revoke stale sessions and contractor permissions, rotate exposed shared secrets, and reduce collection of customer information that the business does not need. A smaller data and access footprint gives attackers fewer opportunities and reduces the material that could be exposed.

Protect identities and software as separate attack surfaces

Account security and vulnerability management need parallel workstreams. Multifactor authentication remains important for email, cloud administration, financial services, hosting, source-code repositories and remote access. Prefer the strongest method each provider supports, eliminate shared logins, place unique credentials in a business password manager and maintain controlled recovery methods for critical accounts.

Software exposure requires its own discipline. Enable automatic updates where operationally safe, define deadlines for internet-facing and critical fixes, subscribe to vendor security notices, and replace products that no longer receive patches. The inventory should show which person or provider is responsible for each update; “the vendor handles it” is not a control unless the agreement and configuration make that responsibility clear.

Apply least privilege to both people and applications. Staff should receive only the access required for their work, administrators should use separate privileged accounts, and integrations should receive the narrowest available permissions. Review high-risk access after role changes and on a fixed schedule rather than waiting for someone to remember.

Backups belong in protection and recovery. Keep multiple copies of essential data, ensure at least one cannot be altered through ordinary production credentials, and protect backup administration with strong authentication. A successful backup notification proves that a job ran; only a documented restore test shows whether usable data can be recovered within the business’s required time.

Design detection for a team that cannot watch dashboards all day

Small online businesses rarely have a round-the-clock security operations team, so alerts must be selective and actionable. Turn on audit logging for the services that control money, customer data, email, domains and infrastructure. Retain logs long enough to investigate an incident, and restrict access so an intruder cannot easily erase the record.

Prioritize alerts for events with a clear response: new administrators, disabled multifactor authentication, unusual login locations, mailbox-forwarding rules, changes to payment details, bulk downloads, newly created API keys and security tools being switched off. Document who receives each alert, the backup contact and the first verification step.

If a provider monitors the environment, define the escalation boundary in writing. The agreement should state what the provider watches, when it contacts the business, which containment steps it may take without approval and what evidence it preserves. This prevents a dangerous gap between a technical alert and a business decision.

Write the incident plan before anyone needs it

An incident plan should be short enough to use under pressure. Define who leads, who contacts technical and legal advisers, who can disable accounts or take systems offline, and who communicates with customers and partners. Keep an offline copy with essential phone numbers because email, cloud storage or the company password vault may be unavailable.

Prepare concise playbooks for the incidents most likely to interrupt an online operation: a compromised email administrator, fraudulent payment instructions, stolen cloud credentials, ransomware, an exposed customer database and a breached service provider. Each playbook should cover verification, containment, evidence preservation, credential changes, operational continuity and internal escalation.

Do not improvise notification obligations. The FTC’s business breach guidance tells US organizations to secure affected operations, preserve evidence, determine what information was compromised and assess which authorities, affected businesses and individuals must be notified; requirements still depend on the data, jurisdiction and industry involved.

Exercise the plan with a spoken walkthrough or tabletop scenario. Ask what happens if the primary administrator is unavailable, the attacker controls email, the latest backup cannot be restored or a key vendor does not respond. Record the decisions and repair the plan, access controls or contracts that failed the exercise.

Turn the framework into a 90-day operating cycle

A strategy becomes real when it produces named tasks, deadlines and evidence of completion. A small business can establish the first cycle without attempting to solve every risk at once:

Days 1–30: name the owner, rank essential services and data, inventory privileged accounts and internet-facing systems, and identify legal or contractual requirements.
Days 31–60: enforce multifactor authentication, remove stale access, patch priority systems, secure account recovery, confirm backup separation and assign monitoring alerts.
Days 61–90: test a restore, rehearse one incident scenario, verify vendor escalation contacts and document remaining risks that require budget or specialist help.

After the first cycle, review the plan when the business launches a service, adopts a major supplier, changes how it handles customer data or experiences an incident. Also schedule a regular review independent of those events. Track a small set of useful measures—critical systems with assigned owners, privileged accounts protected by multifactor authentication, overdue high-priority updates, successful restore tests and unresolved exercise actions—rather than a long dashboard that no decision-maker uses.

The result is not a promise that a breach cannot happen. It is a repeatable system for deciding what matters, reducing the most relevant exposure, noticing suspicious activity and restoring the business with less improvisation.

Your Online Business Needs More Than Passwords: Build a Six-Part Security Plan