Protect your small business from ransomware.

An actionable guide for small businesses

From bookstores and flower shops to law offices and restaurants, small businesses face cyber threats like ransomware every day. But you don’t need a technical background or a big budget to protect your business – you just need a plan, one step at a time.

This Blueprint Basics guide will walk you through the highest-priority actions you can take to protect your small business, either by using one spreadsheet and one document of to-dos or by providing you with the materials needed to hand it off to an IT provider.

🌸 Throughout this guide, Flo’s Flower Shop will be our guiding example.

00Start here

How would you like to proceed? Either way works, and you can switch anytime.

Do it yourself

Take it step by step

Start with one small, 5-minute action, and then go at your own pace. We promise to provide you with no jargon, plain instructions, and a checklist you can follow.

Show me the first step →

Get help

I’d rather hand this off

Jump straight to the questions to ask your IT provider, along with a one-page checklist you can hand to them, an employee, or a tech-savvy friend.

Take me to the hand-off materials →

🛡️Good to know: these steps are low-risk, and you can go at your own pace.

What's at stake

Flo arrives at her flower shop Monday morning and finds a note in every folder on every computer:

“Your network has been breached. Your files are encrypted and your data has been copied. Contact us within 72 hours or we publish it.”

Her customer orders, invoices, delivery schedules — locked, and possibly about to be leaked. When she reaches the attackers, the price is $50,000. This is ransomware, and it happens to flower shops, law offices, and restaurants every day. The steps below make it far less likely — and far less painful if it ever happens.

01Set up multi-factor authentication (MFA) for your business email

⏱ About 5 minutes👤 Just you✅ Can’t break anything

This is the most important recommendation you’ll read today. Multi-factor authentication (MFA) establishes a second line of defense; if someone tries to impersonate you by using your password, they won’t be able to access the account without a unique code only you can access. Start with email: it's the key to resetting passwords for every other account you own, so it's the first to secure.

To start, open your provider’s link, sign in, and choose how you'll confirm it's you (whether an app or a text code). Enter the code once to confirm. That's it.

Tip from the pros: If you’re offered a choice, choose an authenticator app over text-message codes. It’s more secure!

That’s it. When you’re ready — today or next week, go to step two.

02Get your governance basics written down

Governance sounds formal, but it’s really just a few notes on how you run things: who has which passwords, where your files live, who to call when something breaks. Most small businesses don’t have dedicated IT staff. For those that do, one employee may own all the institutional knowledge. Having it documented makes it so that a sick day, a resignation, or an attack doesn’t mean starting over.

Security without governance is a single point of failure.

Why start with governance?

The Center for Internet Security’s Critical Security Controls® (CIS Controls®) v8 represent a minimum standard of information security for large-scale enterprises and are what should be applied to defend against the most common attacks. From these guidelines, the Institute for Security and Technology’s Ransomware Task Force developed the Blueprint for Ransomware Defense – 40 essential cyber safeguards curated from the CIS Controls® for small- and medium-sized enterprises (SMEs), carefully selected not only for ease of implementation but for effectiveness in defending against ransomware attacks.

Make a spreadsheet of what data you have and where it lives

Govern: One of 5 core functions in the NIST Cybersecurity Framework 2.0. Govern means establishing, communicating, and monitoring expectations and policy for an organization’s cybersecurity risk management strategy.Foundational: One of two types of Safeguards featured in the Blueprint for Ransomware Defense. Foundational Safeguards are non-technical actions that serve as the building blocks for essential cyber hygiene.

⏱ ~30 min👤 Just you

Make a list of the types of sensitive information your business handles — customer names, payment info, employee records, contracts — and note where each type is stored. You can’t protect what you don’t know you have.

🌸 Flo’s Flower Shop example

Flo keeps a simple spreadsheet on her desktop. It tells her: customer order history is in her point-of-sale (POS) system, employee payroll is with her accountant, and supplier contracts are in a Google Drive folder only she can access. When her bookkeeper asks for access, Flo knows exactly what to share — and what to keep restricted.

📄 What it looks like — Flo’s data map

↓ Editable spreadsheet ⧉ Copy to Google Sheets

Type of data	Where it’s stored	Who has access	Sensitive?
Customer orders	Square (POS)	Flo, staff	Yes
Payroll	With accountant	Flo, accountant	Yes
Supplier contracts	Google Drive	Flo only	No
＋ your data…

Have a written process for setting up devices and internet access

⏱ ~15 min/device👥 You or your IT provider

When you buy a new computer or router, how do you set it up? If your experience ends with plugging it in, that’s an easy vulnerability to address. Use this checklist to make sure your devices and internet are securely configured — and stay that way.

🌸 Flo’s Flower Shop example

Flo’s nephew set up her router. She asked him to write down how he did it, and exactly what settings he used. She keeps this checklist with her other important business documents. When she gets a new tablet for taking orders at the shop, she follows the same checklist.

📄 What it looks like — Flo’s setup checklist

↓ Print-ready template ⧉ Copy to Google Docs

New device setup

Change default passwords on new devices and routers
Turn on automatic updates and built-in firewalls
Establish separate guest Wi-Fi

Open the template in Google Docs ↗

Have a process for giving — and taking away — access

⏱ ~15 min each time👤 Just you

Who has the passwords to your business accounts? What happens when an employee leaves? Many ransomware attacks succeed simply because a former employee’s account was never disabled. This is why it is critical to document how you handle access when someone joins or leaves.

🌸 Flo’s Flower Shop example

When Flo hires a seasonal helper for the spring rush, she adds them to the POS system, but not to her business email or accounting software. When summer comes around, her 5-minute offboarding checklist ensures she disables their login before they walk out the door.

📄 What it looks like — Flo’s offboarding checklist

↓ Print-ready template ⧉ Copy to Google Docs

Last day checklist

Disable logins
Change any shared passwords
Remove accounts from email, POS, and accounting

Open the template in Google Docs ↗

Turn on automatic updates and stay current

⏱ Set once, ~10 min/mo👥 You + your IT provider

The easiest step! Turn on automatic updates everywhere you can — such as your browser (Chrome, Firefox), your operating system (Windows, macOS), or your productivity tools (Word, Illustrator) — and most of this takes care of itself. Ransomware often gets in through unpatched software, and a few things — often your router/Wi-Fi equipment or an older POS — may not update on their own. For these devices, a responsible person and a monthly reminder keep you covered.

🌸 Flo’s Flower Shop example

Flo sets a recurring reminder in her calendar every first Monday of the month: Check for updates on the shop computer and the POS system. The whole process takes 10 minutes. She talked to her IT provider, and they handle the router remotely.

📄 What it looks like — Flo’s update schedule

↓ Editable spreadsheet ⧉ Copy to Google Sheets

What needs updating	Auto-update?	Responsible	Last checked
Shop computer	Yes	Flo	Oct 2026
POS (Square)	Yes	Auto	Oct 2026
Design software	No	Flo (monthly)	Oct 2026
＋ your software…

Nice work. If you’ve done the steps above, you’ve already closed the doors most ransomware walks through. Keep going — the rest takes you from protected to resilient.

Know who’s logging into your systems, and keep a record

⏱ ~20 min👥 You or your IT provider

Activity logs act as a security camera for your computer systems. If something goes wrong, you’ll be able to see what happened and when. Most systems create logs automatically — you just need an archival process, so you know where to look in an emergency.

🌸 Flo’s Flower Shop example

Flo doesn’t read activity logs daily — she doesn’t need to. But she knows her Google Workspace account shows login history, and her IT provider keeps 90 days of logs on the business network. If something seems off, she knows whom to call.

📄 What it looks like — Flo’s log map

↓ Editable spreadsheet ⧉ Copy to Google Sheets

System	Keeps logs?	Kept how long	How to access
Business email	Yes	6 months	Admin → Reports
Square (POS)	Yes	1 year	Dashboard → Activity
Network / router	Yes (MSP)	90 days	Ask the MSP
＋ your system…

Back up your data and know how to recover it

⏱ ~1 hr, test yearly👥 You + your IT provider

This is the big one. If your business is hit with a ransomware attack, can you recover? A documented data recovery process ensures you aren’t making critical decisions under pressure. You already know what’s backed up, where it is, and how to restore it.

🌸 Flo’s Flower Shop example

Flo’s most important data — customer orders, vendor contacts, financial records — backs up automatically to the cloud every night. She keeps a laminated card in her office safe: “If we get hacked, call [IT provider phone number]. Last tested backup: [date].” She updates the date every 6 months.

📄 What it looks like — Flo’s recovery plan

↓ Print-ready template ⧉ Copy to Google Docs

If we get hacked

Call IT provider:
Last tested backup:

Open the template in Google Docs ↗

Train your team to spot and avoid threats

⏱ ~30 min/year👥 You + your team

One of the most common ways ransomware gets in is a phishing email — a fabricated message that tricks someone into clicking a bad link or opening a dangerous attachment. A 30-minute annual training session for your staff is one of the best investments you can make.

🌸 Flo’s Flower Shop example

Every January, Flo spends 20 minutes with her two employees going over the basics: what phishing looks like. She tells them, “If you doubt an email, call the sender back on a number you trust,” and what to do if they think they’ve clicked something suspicious.

📄 What it looks like — Flo’s training page

↓ Print-ready template ⧉ Copy to Google Docs

Annual security training

Cover phishing basics + the call-back rule (once a year)

Open the template in Google Docs ↗

Plan what to do if you get hit with ransomware

⏱ ~30 min👤 Just you

The worst time to figure out your plan is when an emergency is happening. Write a one-page incident response plan now — whom to call, what to shut down, how to report — so you’re not paralyzed in a crisis.

🌸 Flo’s Flower Shop example

Flo printed a laminated card and taped it inside the top drawer of her desk. It lists three phone numbers and three numbered steps. Her employees know where it is. She reviews it to make sure it’s updated once a year.

📄 What it looks like — Flo’s break-glass card

↓ Print-ready template ⧉ Copy to Google Docs

Break glass in case of emergency

1.Disconnect affected machines from the internet
2.Call IT provider
3.Report the attack to the FBI at ic3.gov

Open the template in Google Docs ↗

Way to go — you’ve taken the most important steps to secure your small business. The last piece is a quick inventory of what you’ve got.

03Take inventory of what you have

You can’t defend what you don’t know you have. With just three short lists — devices, software, and accounts — you are laying the foundation everything else builds on. They’re also exactly what you’d hand to an IT professional in the event of an attack. Quick to do, big payoff.

Keep a list of every device your business uses

Identify: One of 5 core functions in the NIST Cybersecurity Framework 2.0. Identify means helping organizations build a clear, foundational understanding of how to manage cybersecurity risk to their systems, people, assets, data, and capabilities.Foundational: One of two types of Safeguards featured in the Blueprint for Ransomware Defense. Foundational Safeguards are non-technical actions that serve as the building blocks for essential cyber hygiene.

⏱ ~30 min👤 Just you

Computers, tablets, phones, printers, routers, point-of-sale terminals — every device that connects to your network is a potential entry point. Build a simple list so you know what you have and can ensure it’s all accounted for in a crisis.

🌸 Flo’s Flower Shop example

Flo keeps a spreadsheet with 7 rows: her shop computer, her personal laptop (which she uses for business email), two employee phones used for deliveries, the POS tablet, the router, and a label printer. That’s it. Knowing what’s there is the first step.

📄 What it looks like — Flo’s device list

↓ Editable spreadsheet ⧉ Copy to Google Sheets

Device	Type	Business / personal	Used for
Shop computer	Desktop	Business	POS, email, bookkeeping
POS tablet	Tablet	Business	Orders & payments (Square)
Router	Network	Business	Wi-Fi / internet
＋ your device…

Know what software and apps your business runs

⏱ ~20 min👤 Just you

Unknown or unauthorized software is one of the most common ways ransomware gets in. Maintain a simple list of approved software for your business, and make sure employees aren’t installing additional apps on work devices. Your software list also doubles as your MFA checklist — a place to reference which apps have multi-factor authentication switched on.

🌸 Flo’s Flower Shop example

Flo’s approved software list is short: Windows, Chrome, QuickBooks, Square, and her design software for custom arrangements. She has a house rule: if an employee wants to install something, they ask first. It takes 10 seconds to say yes or no.

📄 What it looks like — Flo’s software list

↓ Editable spreadsheet ⧉ Copy to Google Sheets

Software / app	Used for	Approved?	MFA on?
QuickBooks	Bookkeeping	Yes	Yes
Square	Point of sale	Yes	Yes
Floral design software	Custom arrangements	Yes	Turn on
＋ your software…

Keep a list of all your business accounts

⏱ ~30 min👤 Just you

Every account — email, bank, cloud storage, social media, vendor portals — is a door into your business. Knowing which accounts exist, who has access, and whether they’re still needed is one of the simplest steps you can take to reduce risk. For every account, turning on multi-factor authentication (MFA) is the single most effective way to keep attackers out.

Tip from the pros: You should not, under any circumstances, keep your passwords for these accounts in this account inventory. While it might seem tempting, that is exactly the kind of thing a hacker would use to quickly take-over all of your accounts.

🌸 Flo’s Flower Shop example

Flo discovered she had three old vendor accounts from suppliers she no longer uses. She closed them — those were open doors into the flower shop’s network. Her password manager now holds 22 business accounts; she’s the only one with the master password. She’s also turned on MFA for every account that offered it.

📄 What it looks like — Flo’s account list

↓ Editable spreadsheet ⧉ Copy to Google Sheets

Account	Who has access	MFA on?	Still needed?
Business email	Flo	Yes	Yes
Square (POS)	Flo, 2 staff	Yes	Yes
Old vendor portal	—	—	No — CLOSED
＋ your account…

04Check your progress

You don’t have to do everything at once. Pick one item, spend an hour on it, and build from there. The best time to set up cybersecurity governance is before you need it.

0 of 12 done

Download the 12-step checklist of foundational controls

05Don’t have in-house IT? Ask the right questions.

Questions to ask your IT provider

Many small businesses hire an IT provider, often referred to as a Managed Service Provider, or MSP, for support. These are the questions you’ll need to ask to align yourself with these controls.

Download IT provider questions

06Additional resources for small businesses

The Blueprint’s advice comes from the CIS Controls, and lines up with the leading small-business guidance from CISA, the FBI, and the Global Cyber Alliance. When you’re ready to learn more, these free resources are the best next steps:

Looking for ways to protect yourself and your loved ones from scams and fraud? Check out PauseTake9.org, which offers tools, tips, guides, and best practices for staying safe online.

07Help us improve this guide

Tell us what worked, what didn’t, and what you’d like to see next. The survey takes just a few minutes, and your answers help us make this guide more useful for small businesses like yours.

An actionable guide for small businesses

00Start here

Take it step by step

I’d rather hand this off

01Set up multi-factor authentication (MFA) for your business email

02Get your governance basics written down

Security without governance is a single point of failure.

Why start with governance?

Make a spreadsheet of what data you have and where it lives

Have a written process for setting up devices and internet access

Have a process for giving — and taking away — access

Turn on automatic updates and stay current

Know who’s logging into your systems, and keep a record

Back up your data and know how to recover it

Train your team to spot and avoid threats

Plan what to do if you get hit with ransomware

03Take inventory of what you have

Keep a list of every device your business uses

Know what software and apps your business runs

Keep a list of all your business accounts

04Check your progress

05Don’t have in-house IT? Ask the right questions.

Questions to ask your IT provider

06Additional resources for small businesses

07Help us improve this guide

HOME PAGE

GET IN TOUCH

JOIN THE CATALINK MAILING LIST