Security Basics for Small-Business Software: MFA, Access, Backups

Most small-business security advice is about devices and phishing. This guide is about something more specific: the business software you choose and how you set it up. Your CRM, phone system, scheduling tool and billing platform hold your customer data, so their settings are your security.

The good news is that the most effective controls are settings, not projects. Many of them take minutes to switch on, if the software offers them.

The recommendations below draw on guidance from the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST) and the Federal Trade Commission (FTC).

Start by choosing software that is secure by default

CISA's Secure by Design initiative puts the responsibility on software makers. It says that "out-of-the-box, products should be secure with additional security features such as multi-factor authentication (MFA), logging, and single sign-on (SSO) available at no extra cost."

Use that as a buying checklist. Before you sign up, confirm that the software:

• Lets an administrator require MFA for every user, not just offer it.
• Supports strong MFA methods, such as security keys or passkeys.
• Has user roles, so you can limit who sees, exports or deletes data.
• Keeps an activity or audit log you can review.
• Lets you remove a user and reassign their records quickly.
• Offers a complete data export.

For vendors that handle sensitive data, the FTC's small-business guidance advises: "Establish processes to confirm that vendors follow your rules. Don't just take their word for it." Asking for an independent security report or a written description of their controls is a reasonable step.

Require MFA, and choose strong methods

NIST's Small Business Quick-Start Guide calls MFA "one of the fastest, cheapest ways you can protect your data," and suggests starting with accounts that can access the most sensitive information. In practice, that means email, banking, payments, your CRM and any admin accounts.

Not all MFA is equal. CISA's guidance ranks options from most to least secure, describing a physical security key as providing "the best protection against phishing," and a code sent by text or email as the most familiar but the one that "provides the weakest protection." NIST notes that FIDO authenticators used with the W3C Web Authentication standard are the most common phishing-resistant option widely available today.

Configure it centrally. In each system's admin settings, make MFA mandatory for all users rather than leaving it optional. Start with administrators and anyone who can export data or change billing.

Check password settings too. NIST's Digital Identity Guidelines, SP 800-63B, published in 2025, say that passwords used on their own should be at least 15 characters, that systems "SHALL NOT require subscribers to change passwords periodically" without evidence of compromise, and that new passwords should be checked against lists of commonly used or compromised passwords. If your software forces monthly changes or odd character rules, that is out of step with current federal guidance.

Give each person only the access they need

CISA's Cyber Essentials advises granting "access and admin permissions based on need-to-know and least privilege." NIST's quick-start guide puts it simply: restrict sensitive information "to only those employees who need it to do their jobs."

In your software, that means:

• One named account per person. Shared logins make it impossible to see who did what or to remove one person's access.
• As few administrators as possible, ideally two so you are never locked out.
• Roles that match jobs: a technician may need their own schedule and customer notes, not the full client export or billing settings.
• Time-limited access for contractors. The FTC advises limiting vendor access "to a need-to-know basis, and only for the time the vendor needs to do the job."

Make offboarding a checklist

CISA recommends policies and procedures "addressing changes in user status (transfers, termination, etc.)," and NIST asks a pointed question: "Are we removing access when they no longer need it?"

When someone leaves or changes roles, work through every system, not just email:

1. Disable their accounts, or their single sign-on account if you use one.
2. Sign them out of active sessions and remove them from mobile apps.
3. Revoke API keys, connected apps and integrations they set up.
4. Reassign their customers, open deals, tasks and calendar.
5. Reassign phone numbers or route their line to someone else.
6. Review the activity log for unusual exports before the departure.

A software inventory makes this possible. The companion guide The Hidden Cost of Disconnected Software explains why fewer, better-connected tools make offboarding easier.

Backups you can actually restore

NIST's quick-start guide recommends "regularly backing up your data and testing your backups." CISA adds protections for backups, including encryption and "offline copies."

Software as a service does not remove this need. Providers protect their infrastructure, but that may not cover a staff member deleting records, a bad import or an account suspension. Schedule regular exports of critical data, such as customers, invoices and appointments, store them somewhere separate that you control, and occasionally test that you can open and use them.

Watch the logs and keep software current

The FTC recommends that cloud users "maintain robust log files so you can continuously monitor" what happens, and pay attention to credible warnings. Turn on login and export alerts where your software offers them, and review admin activity monthly.

For any software you install, the FTC's advice is to "turn on automatic updates." It also reminds businesses that relying on a provider's tools does not end your obligations: "if it's your data, it's ultimately your responsibility."

Key takeaways

• Choose software that offers MFA, roles, logging and SSO without a costly upgrade, as CISA's Secure by Design guidance recommends.
• Make MFA mandatory in each system's admin settings, and prefer security keys or passkeys over text codes.
• Use one account per person, few administrators and time-limited contractor access.
• Treat offboarding as a checklist across every system, including integrations and phone numbers.
• Keep regular exports of critical data somewhere you control, and test them.
• Review activity logs and alerts; your provider's security does not replace your own.

Sources

• Cybersecurity and Infrastructure Security Agency, Secure by Design
• Cybersecurity and Infrastructure Security Agency, Require Multifactor Authentication
• Cybersecurity and Infrastructure Security Agency, Cyber Essentials
• National Institute of Standards and Technology, SP 1300: NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide (February 2024)
• National Institute of Standards and Technology, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (August 2025)
• Federal Trade Commission, Cybersecurity for Small Business
• Federal Trade Commission, Six Steps Toward More Secure Cloud Computing (June 15, 2020)