All Security Guides, by Topic
Index updated .
Every guide on this site, grouped into five sections that follow the weekday themes of the daily briefing. Each guide covers one specific small-business security problem, tells you exactly what to do and where, explains why it matters, and ends with a way to confirm it worked. If you only do one thing, restore one file from your backup — it shows whether your recovery plan is real.
How these guides are written
Every page follows the same shape, because it makes them faster to use and easier to trust. A short, quotable answer sits directly under the heading. The body gives the actual checks, each one paired with the condition driving it and a way to verify it yourself — using built-in or free tooling. Then the reasoning is explained in words, and a worked example runs through a case with clearly hypothetical numbers. Figures that cannot be verified are left out rather than estimated, and every page links the agencies it relies on alongside a visible last-reviewed date. The editorial standards are on the About page.
The five sections
Backup & Recovery for Small Business
Four backup guides for small businesses: the 3-2-1 rule, immutable and offline copies, restore testing, and recovery-time planning for ransomware and outages.
Start with: Restore testing →Identity, MFA & Access for Small Business
Four identity guides for small businesses: multi-factor authentication, session and token control, password managers and passkeys, and leaver account hygiene.
- MFA for everyone, admins first
- Session and token control
- Password managers and passkeys
- Joiners, movers and leavers
Email, Payments & Fraud for Small Business
Four fraud guides for small businesses: business email compromise, payment-change verification, SPF, DKIM and DMARC email authentication, and phishing reporting.
- Business email compromise
- Payment-change verification
- SPF, DKIM and DMARC
- Phishing reporting and mailbox rules
Endpoints, Patching & Privilege for Small Business
Four endpoint guides for small businesses: patching known exploited vulnerabilities, internet-facing exposure, local admin rights, and endpoint protection hardening.
- Patching known exploited vulnerabilities
- Internet-facing exposure
- Local admin rights and privilege
- Endpoint protection hardening
Vendors, Insurance & Response for Small Business
Four guides for small businesses: what to expect from an MSP, tracking vendors and SaaS, meeting cyber insurance requirements, and the first hour of incident response.
- MSP security expectations
- Vendor and SaaS inventory
- Cyber insurance requirements
- The first hour of incident response
Tools that go with the guides
Four free tools handle the parts of these decisions that involve arithmetic or structure — what an hour of downtime costs, how long a restore will take, how ready you are against common ransomware paths, and what a DMARC record should say. They run in your browser, show their formulas, and use only the numbers you enter. Open the tools.
Frequently asked questions
Where should I start if I only do one thing?
Restore one file from your backup to a different folder and open it. It takes a few minutes and tells you whether the control your recovery depends on works at all.
Are these guides written for a specific environment?
They assume the most common small-business setup, Microsoft 365 with Windows computers, and add a short note where Google Workspace or a hybrid on-premises directory differs. Always confirm menu names against your own plan and current vendor documentation.
How often are the guides reviewed?
Each guide carries a visible last-reviewed date and links the agencies it relies on. Vendor menus and threat details change faster than any guide, so the source links matter as much as the instructions.
Do these guides replace the daily briefing?
No. The guides cover durable practice. Today's exploited vulnerabilities and scams belong to the daily briefing and to the agencies it cites, and you should reconfirm anything time-sensitive before you act.
Do I need to read these in order?
No. Each section is independent and each guide stands alone. The five sections follow the weekday themes of the daily briefing: backup on Monday, identity on Tuesday, email and payments on Wednesday, endpoints on Thursday, vendors on Friday.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.