1. Turn on multi-factor authentication
Enable MFA on email, banking, payroll, your website host, domain registrar and social accounts. It blocks most attacks that rely on stolen passwords.
2. Use a password manager
Unique, long passwords for every account, stored in a business password manager with shared vaults for the team. Remove access the day someone leaves.
3. Back up, and test the restore
Follow the 3-2-1 rule: three copies of important data, on two kinds of storage, with one copy off-site or offline. A backup you have never restored is a guess.
4. Keep everything updated
Turn on automatic updates for computers, phones, browsers, routers, cameras and POS systems. Replace devices that no longer receive security updates.
5. Separate your Wi-Fi
Keep a guest network for customers, separate from the network your registers, cameras and office computers use. Change default router passwords.
6. Train for phishing
Most breaches start with an email or text. Teach your team to verify payment changes and urgent requests by phone, using a number you already have.
7. Write it down (required in Massachusetts)
Massachusetts regulation 201 CMR 17.00 requires businesses that own or license personal information about Massachusetts residents to have a written information security program (WISP) with safeguards that fit the size of the business. A WISP does not need to be long, but it must exist and be followed.
8. Know what you would do
Keep a one-page plan: who to call, how to isolate a computer, where backups are, and when you must notify customers or the state.
How we help
We run cybersecurity audits, set up MFA, backups and network separation, harden websites and help you put a practical written security program in place.