Your 30‑Day Cyber Safety Plan (Made for Small Business Owners)

(Made for Small Business Owners)

Why this matters
Most downtime and data loss come from small, fixable things: missed updates, weak logins, and backups that don’t actually restore. This plan fixes the basics in 30 days without derailing your week.

Time needed
About 2 hours per week for 4 weeks. Owner or office manager can lead it. We can help or do it for you.

Quick wins (do these first)

1. Turn on 2‑step sign‑in for email and key apps
2. Test a restore for one file or folder
3. Run updates on all computers

1) Week One

Accounts & Access (who can get in)

Goal: Stop easy break‑ins.

• List who has access to email, finance, files, and admin tools.

• Enforce 2‑step sign‑in (MFA) for email and remote access.

• Turn off old/legacy sign‑in methods you don’t use.

• Use a password manager or longer passphrases.

Outcome: You know who has access, and every login needs a code.

2) Week Two

Backups that Actually Work

Goal: Be sure you can get data back fast.

• Follow 3‑2‑1 backups: 3 copies, 2 places, 1 off‑site.

• Do a restore test for one file and one shared folder.

• Set targets: how much data you can lose (RPO) and how long you can be down (RTO).

• Make sure Microsoft 365/Google keeps deleted files long enough.

Outcome: You’ve proven recovery works — not just that backups ran.

3) Week Three

Devices & Wi‑Fi

Goal: Keep computers healthy and limit damage.

• Turn on automatic updates for Windows/macOS and browsers.

• Use modern threat protection (advanced antivirus/EDR).

• Turn on disk encryption (BitLocker/FileVault).

• Remove everyday admin rights.

• Split Wi‑Fi into staff and guest networks.

Outcome: Fewer infections, and lost devices don’t leak data.

4) Week Four

Email & Vendors

Goal: Cut scams and lock down outside access.

• Add an External label to outside email.

• Block risky logins; require compliant devices for access.

• Review vendor access (bookkeeper, web developer, software support); remove what you don’t need; rotate shared passwords.

• Alert on suspicious inbox rules/forwarding.

Outcome: Less phishing risk, fewer surprise logins, cleaner vendor list.

10‑Point Scorecard

(check what is true today)

1. Up‑to‑date list of devices and apps
2. 2‑step sign‑in is on
3. Old/legacy sign‑in is off
4. 3‑2‑1 backups in place
5. Restore test done this month
6. Threat protection on all computers
7. 90%+ devices updated on time
8. Laptops encrypted
9. “External” tag on outside email
10. Vendor access reviewed

Helpful links

1. Managed IT:
2. Cybersecurity:
3. IT Audits & Assessments:
4. Cloud & Microsoft 365 Support:

Next step:

Book a free 10‑minute IT health review:
businesscomputertechnicians.com/contact/