A security baseline a ten-person company can actually maintain
Small companies do not get compromised by sophisticated adversaries. They get compromised by a reused password, an unprotected email account, and an ex-employee whose access nobody removed. The defences are unglamorous and mostly free.
1. Multi-factor authentication, starting with email and money
If you do one thing, do this. Enable MFA on the accounts that control everything else, in this order: business email, domain registrar, DNS, hosting, payment gateway, bank, code repository, and cloud console.
| Method | Verdict |
|---|---|
| Hardware security key or passkey | Strongest. Resists phishing because the credential is bound to the site |
| Authenticator app code | Good. The sensible default for most teams |
| Push approval | Fine, but people approve prompts reflexively when spammed |
| SMS codes | Weakest. Better than nothing, vulnerable to SIM swap. Avoid for the registrar and bank |
Store recovery codes in your password manager, not in the same inbox they protect.
2. A team password manager, and no shared logins
Credentials in chat threads and spreadsheets are the normal state of a growing business, and the reason one leaked password becomes ten compromised accounts. A team password manager gives you individual accounts, shared vaults by role, and — the part that matters most — the ability to revoke one person's access without changing everybody's passwords.
One shared master login for the whole team defeats the purpose. So does a vault protected by a password someone also uses elsewhere.
3. Offboarding that actually removes access
Write the checklist once, use it every time, and have someone other than the leaving employee run it.
- Disable the email account. Do not delete it immediately; forward or archive it first.
- Revoke sessions and app passwords, not just the password. An active session survives a password change on many services.
- Remove them from every shared vault, then rotate any credential they could have copied.
- Transfer ownership of files, calendars, domains, and cloud projects before the account is disabled.
- Remove access to repositories, cloud consoles, payment tools, ad accounts, and client systems.
- Check third-party tools nobody remembers: analytics, social accounts, support inbox, CI, and the client's own systems.
4. Backups you have restored at least once
An untested backup is a belief, not a control. Follow the 3-2-1 idea: three copies, two different media or services, one off-site and outside the account that holds the original. That last clause is what protects you when an account is compromised or a subscription lapses, and it is the clause people skip.
Ransomware and accidental deletion both defeat sync-only setups, because the sync faithfully replicates the damage. You need versioned history, and you need to know how far back it goes.
5. Device basics
- Full-disk encryption on every laptop and phone. A stolen laptop should be a hardware loss, not a data breach.
- Automatic operating system and browser updates, on by default.
- A screen lock with a short timeout.
- No shared user accounts on a shared machine.
- Personal devices accessing company mail need a lock screen and remote wipe, agreed in writing before it is needed.
6. Least privilege, applied lazily but consistently
Nobody needs admin on everything, and giving everybody admin is how a single phished account becomes a company-wide incident. You do not need a formal access-control policy; you need three habits: grant the smallest role that lets someone do the job, review roles when someone changes role, and keep exactly one break-glass admin account with MFA and a recovery path documented somewhere physical.
7. Recognising the attacks that will actually arrive
| Attack | What it looks like | Defence |
|---|---|---|
| Invoice fraud | A supplier emails new bank details, often mid-thread | Verify account changes by phone, using a number you already had |
| Credential phishing | A convincing login page after an urgent email | Passkeys or security keys; check the domain before typing |
| MFA fatigue | Repeated push prompts until someone taps approve | Codes or keys instead of push; report unexpected prompts |
| Domain expiry | Nobody renewed; email and site both stop | Auto-renew, plus a calendar reminder on a second person |
| Ex-employee access | Discovered months later, by accident | The offboarding checklist above |
What you can safely defer
At ten people, you do not need a SOC, a SIEM, penetration testing, or a compliance certification unless a client contract requires one. Buying those before the basics is the security equivalent of installing a vault door on a tent. Revisit when you handle regulated data, when a customer's contract demands it, or when headcount makes informal process unworkable.
Write down who to call
Keep a one-page document, stored somewhere reachable when your systems are not, listing: who to contact at your hosting provider and bank, where the domain is registered, who holds the break-glass credentials, and the first three steps if an account is compromised. During an incident, nobody researches. They follow the page or they improvise badly.
No company paid for placement in this article. Verify current prices and terms with each provider before buying.