# FTC Cybersecurity Basics for Small Business: A Plain-English Checklist

> Turn the FTC's small business cybersecurity guidance into a checklist: updates, backups, MFA, passwords, router settings, email authentication and a response plan.

Source: https://www.epifive.com/blog/ftc-cybersecurity-basics-small-business · Published 2026-10-29 · EpiFive

## Key takeaways

- The FTC recommends automatic updates, regular backups kept in the cloud or on an external drive, and offline backups as a ransomware defense.
- Use passwords of at least 12 characters, never reuse them, and require multi-factor authentication for sensitive information.
- Change default router credentials, disable remote management, use WPA2 or WPA3, and keep guests on a separate network.
- Ask your email provider to support SPF, DKIM and DMARC to make spoofing of your domain harder.
- Disconnect a ransomware-infected device without powering it off, and contact the FBI and regulators; law enforcement does not recommend paying.

The FTC's small business cybersecurity guidance comes down to a short list of actions: update software automatically, back up files and keep an offline copy, use passwords of at least 12 characters with multi-factor authentication (MFA), encrypt devices, secure your router, train staff, and write an incident response plan. This article turns that guidance into a checklist you can finish in an afternoon and revisit each quarter.

It is for owners and part-time IT managers at US small businesses who want a starting point without jargon. By the end you will have a prioritized list that follows the order the FTC uses: basics, the NIST framework functions, email authentication, remote access, vendors and common attacks. The recommendations come from the FTC's Cybersecurity for Small Business pages, read on October 29, 2026. The FTC updates these pages, so check them for changes.

## Start with the basics

The FTC's Cybersecurity Basics section covers protecting data, protecting your wireless network, and making security routine. The concrete advice:

- **Update on a schedule.** Schedule software and operating system updates and turn on automatic updates.
- **Back up key files.** Save backups in the cloud or on an external drive.
- **Lock up what is sensitive.** Secure paper files and devices that hold sensitive data, limit access, and keep only the data you need.
- **Dispose properly.** Shred paper and securely wipe devices. The FTC notes that deleting alone is not enough.
- **Use strong passwords.** At least 12 characters, or a passphrase, never reused, with a limit on failed login attempts.
- **Encrypt.** Laptops, phones, removable drives, backups, cloud storage and sensitive data sent to outside parties.
- **Require MFA.** Especially for sensitive information.
- **Train staff regularly.** And have an incident response plan.

See [rolling out MFA to staff](https://www.epifive.com/blog/small-business-mfa-rollout-staff-checklist) for how to introduce the second factor without a support flood.

## Protect your wireless network

The FTC's router advice is specific:

- Change the default router credentials and log out of the admin account when done.
- Disable remote management.
- Use WPA2 or WPA3 encryption.
- Limit the main network to business-managed devices and set up a separate guest network.

For step-by-step help, see [changing router defaults and updating firmware](https://www.epifive.com/blog/router-firmware-update-change-default-password-office) and [setting up a guest Wi-Fi network](https://www.epifive.com/blog/small-business-wifi-guest-network-security-setup).

## Use the NIST framework as a checklist

The FTC organizes the rest of its guidance around the NIST Cybersecurity Framework's functions. Here is each one translated into tasks.

| Function | Tasks from the FTC page |
|---|---|
| Govern | Set a cybersecurity policy, document legal and contractual requirements, consider cyber insurance, assess third-party risks, enforce the policy |
| Identify | Inventory assets and data, assess risks, communicate policies, securely destroy old data, create an incident response plan |
| Protect | Control access, require MFA for everyone, automate security updates, restrict and encrypt sensitive data, change default passwords, back up regularly, train staff |
| Detect | Monitor systems, investigate unusual activity, check for unauthorized users or connections |
| Respond | Maintain and regularly test incident response, disaster recovery and business continuity plans |
| Recover | Restore affected systems, keep stakeholders informed, update policies with lessons learned |

A practical first pass:

1. List every computer, phone, server, cloud service and the sensitive data in each (Identify).
2. Turn on automatic updates and MFA everywhere it is offered (Protect).
3. Decide who notices unusual activity and how they report it (Detect).
4. Write down what to do in the first hour of an incident (Respond), and see the [disaster recovery plan template](https://www.epifive.com/blog/small-business-it-disaster-recovery-plan-template) for a structure.
5. Practice restoring a backup and note what you would change (Recover).

## Email authentication

Spoofed email can damage trust in your domain. The FTC advises making sure your email provider supports three standards: SPF, DKIM and DMARC, or choosing a provider that can configure them for you.

If your email is spoofed, the FTC says to:

1. Report it to the police, IC3.gov and the FTC.
2. Forward phishing emails to reportphishing@apwg.org.
3. Notify customers with an email that contains no links.
4. Direct affected customers to IdentityTheft.gov.
5. Alert staff.

## Secure remote access

For staff who work from home or travel, the FTC recommends:

- Updating router names and passwords, and keeping router firmware current.
- Enabling full-disk encryption on laptops.
- Stopping devices from connecting automatically to public Wi-Fi.
- Considering a VPN, and requiring WPA2 or WPA3 on home routers.
- Requiring unique, complex passwords, locking unattended workstations and using MFA for sensitive areas.
- Writing the rules down and vetting devices before they connect.

## Vendor security

Vendors and web hosts often hold your data or have access to your network. The FTC advises:

- Include security provisions in contracts and define data-handling rules.
- Verify vendor compliance independently, for example through third-party assessments.
- Restrict vendor access by need and time, encrypt data, require strong passwords and MFA.
- If a vendor is breached, report to police, the FBI and industry regulators, confirm the fix, check whether the vendor was used to access your network, and notify affected parties.

When hiring a web host, the FTC says to look for current TLS, email authentication (SPF, DKIM, DMARC), timely software updates and clear responsibility for website management.

## Common attacks and what to do

### Phishing

Verify senders independently, check URLs and addresses, avoid logging in through email links, and call a known number to confirm unusual requests. Keep offline backups and give staff an easy way to report suspicious email. If phishing succeeds: alert colleagues, change passwords, disconnect infected devices, notify affected people, forward the email to the APWG and report to the FTC.

### Ransomware

Keep offline backups, maintain a continuity plan, patch systems and train staff. If attacked, the FTC says to disconnect devices without powering them off, investigate with qualified staff, contact the FBI and regulators, activate your continuity plan, weigh ransom decisions carefully and notify affected parties. It notes that law enforcement does not recommend paying.

### Business email imposters

Use email authentication, keep systems updated, train staff, and require phone verification for wire transfers. If your business is spoofed, report to law enforcement, IC3.gov, the FTC and the APWG.

### Tech support scams

Hang up on unexpected tech support calls, ignore pop-ups, contact vendors using verified numbers, and never share passwords or grant remote access. If you were scammed: change passwords, remove malware, disconnect affected computers, contact your card issuer about charges and report to the FTC.

## Insurance and next steps

The FTC also has a cyber insurance page. If you plan to buy a policy, read [cyber insurance for small business and the controls insurers ask for](https://www.epifive.com/blog/small-business-cyber-insurance-requirements).

## Quarterly checklist

- Automatic updates on for operating systems, apps and the router.
- Backups running, one copy offline or in the cloud, restore tested.
- Passwords of 12 or more characters, MFA on email, admin and finance accounts.
- Laptops, phones and removable drives encrypted.
- Router default credentials changed, remote management off, WPA2 or WPA3 on, guest network separate.
- SPF, DKIM and DMARC configured for your email domain.
- Vendor access reviewed and contracts include security terms.
- Staff trained and know how to report suspicious messages.
- Incident response plan reviewed and contacts current.

## References

- [FTC: Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity)
- [FTC: Cyber Insurance](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance)

## Frequently asked questions

### What are the FTC's cybersecurity basics for small businesses?

The FTC's guidance covers keeping software updated, backing up files, using long unique passwords and multi-factor authentication, encrypting devices and data, securing your router, training staff and having an incident response plan. It also covers email authentication, vendors and common attacks.

### How long should business passwords be, according to the FTC?

The FTC recommends passwords of at least 12 characters, or passphrases, never reused across accounts, with a limit on failed login attempts.

### What should I do first if my business email is spoofed?

The FTC says to report it to police, IC3.gov and the FTC, forward phishing emails to the APWG address it lists, tell customers using an email without links, point affected customers to IdentityTheft.gov, and alert staff.

### Should I pay a ransomware demand?

The FTC's page says law enforcement does not recommend paying. It advises weighing the decision carefully, disconnecting affected devices without powering them off, and contacting the FBI and regulators.