Five computers, one accountant, an inbox full of invoices — and no one to take care of the tech. That’s the IT reality in most small businesses that come to our shop. The owner knows “something should be done about it,” but it never happens between orders.
The good news: basic small business security doesn’t need an IT department or expensive software. You can handle almost everything below with tools already built into Windows. For each step, you’ll find three things: why do it, how much time it actually takes, and what you risk by skipping it.
In a nutshell: If you can’t do everything, at least follow the order of impact — first, backups with an offline copy (step 4), then updates (step 2), and working without admin rights (step 1). Fill in the rest gradually over a few weeks. And if you know you won’t get to it yourself, there’s a way to leave it to us at the end of the article.
1. Separate accounts without admin rights
When everyone works under a single “Office” account with administrator rights, every program anyone runs has the same rights. Malicious code running under an admin account can turn off protections, embed itself in the system, and touch everything the computer can reach. Under a standard user account, its reach is much smaller — and Windows will only ask for an admin password when something is actually being installed or changed.
How to do it: In Settings → Accounts → Other users, create a Standard User account for each person. Keep a single administrator account with a strong password known only to the owner or one designated person — and don’t use it for everyday work. Delete shared accounts: if something goes wrong, you need to know who was logged in.
Time estimate: creating accounts is a matter of minutes; transferring documents and settings to new profiles will take up to an hour per computer.
Without it: one click on an infected attachment under an admin account hands the entire computer to an attacker — including the ability to disable your antivirus and encrypt or delete everything connected to it.
2. Windows and program updates
Small businesses often think they aren’t interesting targets for attackers. But a large portion of attacks today aren’t run manually — automated bots broadly scan for machines with known, long-patched flaws. Updates close these holes; delaying them leaves an open door with instructions publicly available.
How to do it: Keep Windows Update turned on and don’t postpone restarts for weeks. Don’t forget your programs — your browser, PDF reader, office suite, and especially your accounting software. You can update them in bulk with the command winget upgrade --all run in the terminal. And if you’re still running Windows 10, remember that mainstream support ended in October 2025 — a machine without security patches is a permanent risk, not a saving.
Time estimate: catching up on missed updates for the first time can take a few hours, but it runs on its own — just leave the computers on over lunch or overnight. After that, it’s a matter of minutes per week.
Without it: an attacker doesn’t need to outsmart anyone. They just need a vulnerability for which a fix has existed for months, but no one installed it.
3. Defender and controlled folder access
Microsoft Defender is part of Windows, costs nothing, and is a sensible foundation for a small business. More important than buying another antivirus is not turning off Defender — typically because of a crack or some online guide — and checking occasionally that Windows Security isn’t reporting a problem.
Add the Controlled Folder Access feature: it protects selected folders (documents, accounting, photos) from being written to by unknown programs, which is exactly ransomware behavior. We described the exact steps to enable it and what to expect in the article Ransomware at Home: How to Defend Yourself — the same applies to business computers.
Time estimate: checking Defender and turning on controlled folder access takes a few minutes per computer. Expect some tweaking in the first week — some legitimate programs will need to be manually allowed.
Without it: a program that starts rewriting your documents en masse won’t hit any obstacle. And that’s precisely where a company has its invoices, contracts, and accounting materials.
4. 3-2-1 backups with an offline copy
Backups are the only measure on this list that works even when everything else fails. A disk failure, a stolen laptop, a human error, or ransomware — with a backup, it’s an inconvenience; without it, it’s an existential problem.
Stick to the 3-2-1 rule: three copies of your data, two types of storage, one copy off-site. The article The 3-2-1 Backup Rule has a detailed guide for both businesses and households; here are just two decisive principles. First: at least one copy must be physically disconnected — an external drive you unplug from the computer after the backup, because a permanently connected backup can be encrypted by ransomware along with the original. Second: a backup you’ve never tried to restore is just a good feeling — occasionally, restore a selected file and verify it’s readable.
Time estimate: setup for a small business is half a day’s work. The ongoing routine costs minutes a week (swapping and disconnecting the drive) and a moment every few months for a restore test.
Without it: anything else from this article can fail completely. A company without its accounting, contracts, and ongoing projects doesn’t lose a day — it loses weeks.
5. Password manager and two-factor authentication
The most common password situation in a small business: one favorite password in three variations, used everywhere. As soon as any service where you have it leaks that password in a data breach, bots will try it on your email, bank, and accounting system. Your business email is the master key — whoever controls it can reset passwords to everything else and write to your clients under your name.
How to do it: deploy a password manager (Bitwarden has a usable free version, KeePassXC works fully offline) and let it generate long, unique passwords. You don’t have to change everything at once — start with your email, bank, accounting system, and Microsoft account. Turn on two-factor authentication for the same accounts, ideally via an authenticator app on your phone, not just SMS, and save the backup codes in case you lose your phone.
Time estimate: introducing a password manager and securing key accounts is an afternoon’s work; fill in the remaining passwords gradually as you get to them.
Without it: a single password leaked from elsewhere is enough to take over your email — and from there, to issue fraudulent invoices sent to your customers.
6. Disk encryption — BitLocker with a saved key
A laptop with accounting data forgotten on a train or stolen from a car: without encryption, the finder can take the disk out, connect it to another computer, and read it. Your Windows password doesn’t prevent this — it protects the login, not the data on the disk. BitLocker encryption (in Windows Pro; the Home edition has simplified Device Encryption on supported hardware) turns a stolen disk into an unreadable block. For client data, it’s also the difference between “we lost a notebook” and a reportable personal data breach.
One major warning: before you turn on encryption, figure out where the recovery key will be stored — in a Microsoft account, printed in a safe, or in the company registry. Windows might ask for it even after a routine update, and without the key, no one can access the data, not even a repair service. We discuss why this happens and how not to lock yourself out in the article BitLocker Asks for the Recovery Key After a Windows Update. You can verify the encryption status with the command manage-bde -status.
Time estimate: enabling it and saving the key takes a few minutes per computer; the encryption itself runs in the background for hours, and you can work normally during it.
Without it: a lost company laptop equals a leak of everything on it. Conversely, encryption enabled without a saved key is a time bomb for losing your own data.
7. Basic rules for email and phishing
Technology alone isn’t enough — the most common gateway into a company is an ordinary email opened in a hurry. You don’t need training costing tens of thousands; you need three rules the team agrees on and that apply without exception:
- A change of bank account number or an urgent payment request is always verified by phone — using a number you know from a source other than that email. Even if “the boss” is writing.
- Unexpected attachments are not opened until you verify through another channel that the sender really sent them. Turn on the display of file extensions in File Explorer.
- Don’t log in through links in emails. Always access your bank and other services through the address typed directly into your browser.
How to recognize a fraudulent email — from the sender’s address to the pressure for urgency — is detailed in the article How to Recognize a Phishing Email. Send it to your colleagues.
Time estimate: one hour-long meeting where you go over the rules with examples, and then an occasional reminder when a new wave of scams appears.
Without it: a fake invoice gets paid because no one verified it. Money sent to a fraudster’s account is very hard to get back — if at all.
No time? Have your security reviewed
A capable person in the company can handle all seven steps with this article in hand. But reality is often different: half gets done, the other half “has to wait” — and no one knows if the backups can actually be restored or where the BitLocker key is stored.
For this scenario, we do a one-time security review: we’ll check accounts and passwords, updates, backups including a real restore test, disk encryption, and email setup, and you’ll get a written output — what’s okay, what’s critical, and what can just be scheduled. We can fix critical issues on the spot. You’ll find the scope and pricing on the IT Audit Brno page; an audit for a small business with up to about ten devices starts at 3,588 CZK, and the initial consultation is free.
If you know you won’t get to the seven steps yourself, order a security review or call 774 777 774 — we’ll walk through it with you, and within a week you’ll know where you stand.