1. Add a second lock to your email
Your email is the key to everything else: password resets, invoices, banking alerts. A second lock, often called multifactor authentication (MFA), means a stolen password alone isn't enough to get in. Turn it on for email first, then banking, payroll, and any account that holds customer information.
2. Use a password manager
Reusing one password everywhere means one leak opens every door. A password manager creates and remembers a different strong password for each account, and lets you share logins with your team without writing them on sticky notes.
3. Turn on automatic updates
Updates fix security holes that attackers already know about. Turn on automatic updates for computers, phones, web browsers, and the software you use every day, and replace devices that no longer receive updates.
4. Run antivirus that watches for break-ins
Modern business antivirus doesn't just scan for known viruses; it watches for suspicious behavior and can stop an attack in progress. Windows includes Microsoft Defender, and business plans many owners already pay for add more monitoring. The key is making sure it's on, current, and covering every work computer.
5. Keep a copy of your files you can actually get back
Backups only count if you can restore from them. A simple rule of thumb: keep three copies of important files, on two different kinds of storage, with one copy somewhere separate from your office network. Then test a restore, so you know it works before you need it.
6. Keep guest Wi-Fi away from your files
Customers and visitors should never share a network with your computers, files, or card reader. Most business routers can run a separate guest network. Keep your payment equipment on its own network too, so a problem on one doesn't reach the other.
7. Teach your team to spot a fake email
Many attacks start with a convincing email: a fake invoice, a “password expired” notice, or a message that looks like it's from the boss asking for a quick payment. A short training session and one firm rule go a long way: any request to change payment details or send money gets confirmed by phone, using a number you already have.
What this costs
Less than most owners expect. Many small businesses already pay for Microsoft 365 or Google Workspace, which include strong security settings that are often turned off. The work is mostly setting things up correctly, not buying expensive gear.
If you'd rather have it done for you, Main Street Ready covers these basics for one fixed price, with no monthly contract. It starts with a free consultation.