Back to catalog
Business securityIntermediate

Cybersecurity for a Small Business

Where to spend first when there is no security team: the decisions an owner makes, what each one costs, and what it actually buys

Cybersecurity for a Small Business

About this course

A course for the person who signs off on the spending: an owner, a founder, a managing or operations director in a company that has no security specialist and is not about to hire one. The subject is not technology. It is a series of business decisions — which systems the company cannot trade without, which protections return the most per unit of money, what to do in the first hour of a bad morning, and which risks you are consciously choosing to keep.

Eleven lessons produce five working documents rather than a reading list: an inventory of critical systems, a one-page incident plan with the phone numbers that matter in the first hour, an offboarding checklist, a vendor review form, and a written procedure for testing that a backup restores. Every recommendation is ordered by return on money, and every lesson says plainly what can be postponed.

The material follows publicly available guidance from CISA, NIST — including its Small Business Cybersecurity Corner — and ENISA, restated for a company of five to fifty people. Outdated habits are dropped: forced password changes every ninety days and character-composition rules are no longer recommended, and this course does not recommend them either. Where rules genuinely differ by country — personal data duties, breach notification, restrictions on ransom payments — the course describes the shape of the obligation and sends you to your own counsel instead of pretending to give legal advice.

Course curriculum

  1. Where to start when there is no budget and no specialist

    The list of systems the business cannot trade without, and the order of spending that follows from it.

    • 1.What would stop the business tomorrow14 min
    • 2.The order of spending: most protection per unit of money16 min

  2. Accounts, devices and money

    Who holds the keys, what happens when someone leaves, how two-factor is deployed, and the one rule that stops invoice fraud.

    • 1.Who holds the keys: admin rights, shared passwords and leaving18 min
    • 2.Two-factor on everything that touches money and mail13 min
    • 3.Laptops, phones and the staff who take them home14 min
    • 4.When the bank details change: invoice fraud15 min

  3. Backups and ransomware

    The copy that actually restores, and what a company does in the first twenty-four hours of an encryption incident.

    • 1.Three copies, and why yours may not count as one16 min
    • 2.Ransomware: what happens, and the first twenty-four hours18 min

  4. The outside world, and the plan

    Your domain and website, the contractors who hold your data, the client data you hold, and the one page that turns a bad morning into a sequence.

    • 1.Your domain, your website and letters sent in your name14 min
    • 2.Contractors, services, and the client data you hold16 min
    • 3.One page, the phone numbers, insurance, and checking it works17 min