cybersecurity plans

Cybersecurity Plans

Building effective cybersecurity begins with a well-thought-out plan, much like starting a business begins with a business plan. For small businesses, cybersecurity planning is also an important part of emergency preparedness, helping organizations prepare for, respond to, and recover from cyber incidents that can disrupt critical operations. Building on the previous section, Cyber Defenses, this section explores strategies and resources for developing and implementing a practical cybersecurity plan. Topics include cybersecurity frameworks, policies, and other resources designed to help businesses turn cybersecurity insights into a repeatable plan and an actionable implementation roadmap. Always consult IT professionals to ensure proper design and implementation of cybersecurity programs.

A small-business cybersecurity plan is a set of decisions, documents, and routines that make security repeatable: who is responsible, what you are protecting, what controls will you use, how you will detect problems, and what you will do when something goes wrong. Effective cybersecurity planning also requires financial resources, including budgeting for security tools, and ongoing maintenance.

Cybersecurity Planning Overview

There are several easy and immediate steps your business can take to better protect its sensitive information from cyberattacks.

Assign ownership – Name a plan owner, define backups for key roles, and document an escalation path for urgent decisions.
Inventory what you have – Maintain a lightweight list of devices, accounts, cloud services, and critical vendors.
Map your “crown jewels” – Identify the data and systems that would disrupt operations if stolen, encrypted, or unavailable (e.g., email, accounting, payroll, point-of-sale, customer data).
Turn security into policies and procedures – Develop clear, easy-to follow policies and procedures for user access, remote work, software installation, data backups, and vendor access. Train employees on these requirements and consistently enforce them.
Build a risk register you can use – Track your top risks in one place, note the mitigation approach (reduce, transfer, accept), and assign an owner and due date for each action.
Prioritize implementation with a simple roadmap – Organize cybersecurity initiatives into short-, medium-, and long-term priorities. Focus first on high-impact, achievable improvements, and align implementation with available budget, staffing and organizational resources.
Test before you trust – Regularly test your cybersecurity capabilities to ensure they work as intended and verify that all backups can be restored.

View the following resources for additional information:

Small Business Resources – CISA (1)
Small Business Quick-Start Guide – NIST (1)
Secure Remote Access Tips – Federal Trade Commission (1)

Cybersecurity Implementation for Small Businesses

The following guidelines will take you step-by-step towards the path of implementing a comprehensive cybersecurity program. Each step is covered in detail by the National Institute for Standards and Technology (NIST) Publication NIST Cybersecurity Framework (CSF) 2.0, which serves as the industry framework.

Function I. Govern

Identify and control who has access to your business information.
Conduct background checks. Perform full nationwide, criminal background and sexual offender checks. If possible, perform a credit check on all prospective employers.
Require individual user accounts for each employee. Require that complex passwords (16-string alphanumeric with special characters) be utilized for each account and changed every 3-6 months.
Create policies and procedures for information security. All employees should sign a statement agreeing that they have read the policies and relevant procedures and that they will comply with the policies and procedures.

Function II. Identify

Identify and control who has access to business information and critical systems.
Use role-appropriate screening for positions with privileged access, consistent with local laws and business needs.
Require individual user accounts for employees and contractors; avoid shared accounts for critical systems.
Set authentication expectations using current NIST Digital Identity Guidelines (passwords/passphrases, MFA where available, and account recovery). NIST Digital Identity Guidelines (800-63-4)
Create basic policies and procedures for information security and have staff acknowledge they have read and will follow them.

View the following resources to assist in identifying vulnerabilities:

Security Guide for Business – Federal Trade Commission (2)
Cyber Hygiene Services – CISA (2)

Function III. Protect

Limit employee access to the data and systems needed for their jobs.
Protect critical equipment (for example, point-of-sale and networking gear) with surge protection and UPS where appropriate.
Patch systems and keep key applications updated; define who owns patching and how it is verified.
Secure business networks (router configuration, strong Wi-Fi encryption, documented admin access).
Use web and email filtering to reduce exposure to known malicious links and attachments.
Use encryption for sensitive information, especially on laptops and mobile devices.
Dispose of devices safely by wiping or destroying storage media when retiring equipment.
Train employees regularly and reinforce expectations for handling sensitive data and unusual requests.

For more detailed information on implementing a cybersecurity plan visit:

Protecting Personal Information – Federal Trade Commission (3)
Cybersecurity Planning Guide – Federal Communications Commission (1)
Interactive Cybersecurity Planning Guide – Federal Communications Commission (2)
Guide to Enterprise Telework, Remote Access, and Bring Your Own Device Security – NIST (2)

Function V. Respond

Develop a short incident response checklist that defines who makes decisions, who contacts vendors, and who communicates with staff and customers.
Document “first steps” (preserve evidence, stop further access, and avoid actions that erase logs before you capture what happened).
Document reporting and notification steps appropriate to the situation (fraud, identity theft, ransomware, or regulated data exposure).

For more detailed information on how to respond to a data breach visit:

Data Breach Response Guide – Federal Trade Commission (4)
Responding to a Cyber Incident – NIST (3)
Data Breach – Experian

Function VI. Recover

Back up important information and test restores periodically to confirm you can recover what you need (restore testing matters more than the backup schedule).
Protect backups (access controls, encryption where appropriate, and recovery instructions that remain accessible if systems are unavailable).
Consider cyber insurance as a risk-transfer tool, based on the business model and exposure.
Improve after incidents through after-action reviews and updates to policies, training, and vendor access.