Cybersecurity Checklist

Small Business Cybersecurity

Today’s cyber threats can impact any company, regardless of size or industry. According to Accenture’s Cost of Cybercrime Study, 43% of cyber-attacks target small businesses. On top of that, only 14% of those businesses are prepared to defend themselves.

Other Cybersecurity Statistics:

• 37 percent of companies hit by ransomware had fewer than 100 employees (accenture.com)
• Globally, the manufacturing sector was the most targeted, representing 20% of all cyber extortion campaigns (Orange Cyberdefense)
• Fifty-five percent of people in the U.S. would be less likely to do business with companies that hackers have targeted. (https://blogs.und.edu)
• 51% of small businesses have no cybersecurity measures in place at all (https://mytechdecisions.com)
• 95% of cybersecurity breaches are attributed to human error (https://securitytoday.com)
• In the U.S., data breaches have affected 88 million people and their health information. This is a 60% increase in 2023 (Chief Healthcare Executive).
• As of 2023, over 72 percent of businesses worldwide were affected by ransomware attacks. (Statista.com)

Small Businesses are Easy Targets

Companies face risks from cyberattacks. They also risk failing to comply with regulations. This can lead to losing customer trust and missing contract opportunities.

How Much Importance Should You Place on Cybersecurity?

Companies are beginning to add cybersecurity experts to their boards. This shows that cybersecurity is becoming more important for business success.

Every business is different. However, all types and sizes of businesses should take cybersecurity seriously. Cybercriminals are attacking businesses of all sizes.

These Questions will help you to Assess the Importance of Cybersecurity for your Business:

• Do you handle critical or sensitive information, such as trade secrets, customer data, research, company financial information, or personally identifiable information?
• Do your customers ever ask about your company’s cybersecurity practices or include it in vendor surveys? Are you required to meet any laws, regulations, or standards related to cybersecurity (e.g. PCI, DFARS/CMMC, HIPPA, GDPR, or others)?
• Did an insurance company turn you down for a cyber policy?
• Do employees work at home using their home networks and personal devices?
• Have you experienced a cyberattack in the past year? This could include ransomware, a computer virus, a denial-of-service (DOS) attack, identity theft, or a data breach.

If the answer to any of the above is “yes,” you have a compelling need for cybersecurity. Failure to comply with cybersecurity regulations can result in lost contracts and costly fines. The rise of remote work increases the need for cybersecurity. The more devices and networks your company uses, the greater the risk.

Cybersecurity Questions to Ask Yourself:

You can use this checklist to better understand where the cybersecurity gaps are in different areas of your business:

Patch Management:

• Are all systems, software, and applications regularly updated with the latest security patches?
• Is there a schedule in place to ensure timely patching?

Network Security:

• Are firewalls and intrusion detection/prevention systems implemented and regularly updated?
• Is there network segmentation to isolate critical systems from potential threats?

Security Training and Awareness:

• Are employees trained in cybersecurity best practices and aware of common threats like phishing?
• Is there ongoing education to keep staff updated on evolving cybersecurity risks?

Incident Response Planning:

• Have incident response plans been developed and tested for different types of cyber threats?
• Is there a designated team and clear communication protocol in case of a security breach?

Vendor Security Assessment:

• Do third-party vendors who have access to your systems adhere to security best practices?
• Is there a process to assess their security measures and protocols?

Monitoring and Logging:

• Are systems monitored in real-time for suspicious activities, and are logs regularly reviewed?
• Is there a system to alert for any anomalies or potential security breaches?

Disaster Recovery and Business Continuity:

• Is there a plan in place for business continuity in the event of a cybersecurity incident?
• Have you tested the effectiveness of this plan in various scenarios?

Employee Offboarding and Device Management:

• Are access rights promptly removed for employees who leave or change roles?
• Is there a policy for secure disposal or wiping of data from devices no longer in use?

Cybersecurity Compliance

Regularly checking your cybersecurity can help spot gaps and keep your systems and data protected.

If the answer is “No” to any of the above questions,  you likely have gaps in your cybersecurity practices.

Cybersecurity Training

Most cyber breaches result from basic human error. This makes employee training a top priority. Without ongoing monitoring, updates, and backups, you leave your technologies open to attack. Review your responses to the checklist questions above.

If you need cybersecurity but have gaps in your practices, your company is at high risk for cyberattacks.

What are the Most Common Cyber Threats Against Small Businesses?

Small businesses often face cyber threats because they have limited resources and weaker security.

Some of the most common cyber attacks targeting small businesses include:

Phishing Attacks:

Emails or messages that look real but are meant to trick people into giving sensitive information or clicking dangerous links.

Ransomware:

Malware that encrypts files or systems, demanding a ransom for their release. Hackers often target small businesses because they’re more likely to pay the ransom.

Credential Attacks:

Brute force attacks or using stolen credentials to gain unauthorized access to systems or accounts.

Supply Chain Attacks:

Targeting vulnerabilities in third-party vendors or suppliers to gain access to the small business’s network or data.

IoT-Based Attacks:

Exploiting vulnerabilities in Internet of Things (IoT) devices connected to the business network.

Social Engineering:

Manipulating individuals within the organization to divulge sensitive information or perform certain actions. These attacks can lead to financial loss, data breaches, operational disruptions, and reputational damage. Small businesses are often targeted because they may have less robust security measures in place compared to larger enterprises, making them appealing targets for cybercriminals.

How Core Can Help

Core Business Solutions stands ready to help. We offer audits and scans to measure your business against national and industry cybersecurity standards.

We’ll help you ascertain your security posture and find gaps. With that information, we can help you build a simple and effective remediation plan.

We can even offer training, expert support, and security technologies to fill the gaps in your security. Contact us today to learn how we can help your business achieve cybersecurity industry standards.

Expert Consulting

Our Standards

Our Solutions

We offer this simple, effective solution to help small businesses meet their cybersecurity needs:

CORE Vault™

Everything you need for NIST/CMMC in one cloud-based solution 

CORE Vault comes ready-made for compliance with the DoD contracting requirements of DFARS, NIST SP 800-171, and CMMC 2.0. 

With CORE Vault™, you can keep government data separate from your network and access it securely in the cloud, managed by our cybersecurity experts.

CORE Vault™ also includes the support needed to reach full compliance with the non-technical cybersecurity requirements, such as your system security plan and required policies. 

The CORE Security Suite

Our online platform gives you all the tools you need for ongoing cybersecurity, including:

• Document and record control
• User-friendly project dashboards
• Incident management
• Security change logs
• Risk register
• Asset management

We also provide standard-specific tools depending on your security requirements. For companies who require NIST/CMMC, we provide a simple SSP tool, an automated SPRS score calculator, and customizable policy templates crafted by our own CMMC experts.