Managed IT Services
Running a business without a security plan is like leaving for vacation with the front door open. That line opened the original version of this article in 2023, and it still holds, but the stakes and the expectations have changed. Cyber insurance carriers now ask to see your plan. HIPAA, the FTC Safeguards Rule, and New Jersey’s privacy law require written programs. Clients send security questionnaires before they sign.
A cybersecurity plan for small business owners is no longer a nice-to-have document; it is the thing that determines whether you get coverage, pass an audit, win the contract, and recover from an attack. This rewritten guide explains what the plan contains, how to create one in a few weeks, and how to keep it alive.
What a Cybersecurity Plan for Small Business Actually Is
Cybersecurity planning is the process of understanding what you need to protect, deciding how you will protect it, and writing that down so the business can act on it consistently. The output is a plan, sometimes called a written information security program or WISP, that covers six functions. These map to the NIST Cybersecurity Framework 2.0, which is the structure regulators and insurers increasingly reference:
- Govern: who owns security, what policies apply, how risk decisions are made.
- Identify: what systems, data, people, and vendors you have, and what the risks to them are.
- Protect: the controls that prevent incidents, from MFA and encryption to training and access management.
- Detect: how you would notice an intrusion: logging, monitoring, and alerting.
- Respond: what happens when something goes wrong, who does what, and who gets notified.
- Recover: backups, restoration priorities, and how the business keeps operating.
A cybersecurity plan for small business use does not need to be long. For a 10- to 100-person practice or firm, a complete plan is usually 15 to 30 pages including policies, and most of it is reusable year to year.
How to Create a Cybersecurity Plan in 7 Steps
Here is how to create a cybersecurity plan for small business use from scratch, in the order that works for small businesses. Each step produces a piece of the final document.
Step 1: Assign an owner and set the scope
Name one person accountable for the cybersecurity plan for small business operations. In a small business that is usually the owner, a partner, or the office manager, supported by an IT provider who handles the technical work. The FTC Safeguards Rule calls this person the Qualified Individual; HIPAA calls for a Security Officer. Define what the plan covers: every location, every device, every cloud service, and every person, including contractors and seasonal staff.
Step 2: Inventory what you are protecting
You cannot protect what you have not listed, so every cybersecurity plan for small business starts with inventories. Build four inventories: devices (computers, servers, phones, network gear), applications and cloud services (including the ones departments signed up for on their own), data (what sensitive information you hold, where it lives, and which regulations apply to it), and vendors who touch that data. Our hardware lifecycle management guide and our post on uncovering unsanctioned cloud apps help with the first two.
Step 3: Assess the risks
The risk assessment is where a cybersecurity plan for small business stops being generic. For each important asset, ask what could go wrong, how likely it is, and how bad it would be. Phishing leading to email compromise, ransomware through an exposed remote desktop, a lost unencrypted laptop, a former employee’s active account, a vendor breach: these are the realistic threats for a New Jersey small business, and the assessment ranks them. A structured security risk assessment produces this ranking and the documentation HIPAA and the Safeguards Rule require.
Step 4: Choose the controls
Match controls to the ranked risks; this is the core of how to create a cybersecurity plan that holds up. For most small businesses the baseline is well established and looks like this:
| Function | Baseline Controls for a Small Business |
|---|---|
| Protect: identity | MFA enforced everywhere; Conditional Access; least privilege; no local admin rights; password manager |
| Protect: devices | Business-class managed devices; full-disk encryption; EDR; automatic patching; MDM on phones |
| Protect: network | Business firewall with active subscription; segmented guest Wi-Fi; no exposed RDP; VPN or Zero Trust access with MFA |
| Protect: data | Encryption in transit and at rest; sharing restrictions; data loss prevention; retention and disposal schedule |
| Protect: people | Security awareness training; phishing simulations; onboarding and offboarding checklists |
| Detect | Audit logging retained; managed detection and response; alerts on risky sign-ins and forwarding rules |
| Respond | Written incident response plan; contact list offline; cyber insurance; tabletop exercises |
| Recover | 3-2-1-1-0 backups with immutable copy; Microsoft 365 backup; tested restores; recovery priorities |
This baseline closely follows the CIS Critical Security Controls Implementation Group 1, which is designed for exactly this size of organization. Our guides to MFA for small business, credential theft protection, and the backup and disaster recovery guide cover the rows that matter most.
Step 5: Write the policies
Policies turn controls into rules people can follow and auditors can check. A small business security policy set typically includes an acceptable use policy, a password and authentication policy, a remote work and device policy, a data classification and handling policy, an access control policy, a vendor management policy, an incident response plan, a backup and recovery policy, and an AI use policy, which is new since the original version of this article. Each should be short, specific to how your business actually works, and acknowledged by staff.
Step 6: Train and communicate
Employees are the control that fails most often, which is why training belongs in every cybersecurity plan for small business teams, and the one that improves fastest with attention. Deliver security awareness training at hire and at least annually, run phishing simulations, and make sure everyone knows how to report something suspicious without fear of blame. Keep records; training logs are among the first things an insurer or investigator asks for.
Step 7: Document, test, and review
Assemble the inventories, risk assessment, controls, policies, and plans into the finished cybersecurity plan for small business review, a single document with a revision date. Test the parts that can be tested: restore a backup, run a tabletop exercise on the incident plan, review who has access to what. Then put the review on the calendar: a full revision annually and after any major change, with quarterly checks on access, licenses, and vendors.
A Cybersecurity Plan Template Outline
If you want to start writing today, this outline is what we use as the skeleton of a cybersecurity plan for small business clients. Fill each section with your own specifics rather than generic language; a plan that describes controls you do not have is worse than no plan when an investigator compares it to reality.
- Purpose, scope, and ownership, including the named security owner and the regulations that apply.
- Asset inventory: devices, applications, data, vendors.
- Risk assessment summary and ranked findings.
- Security controls by function, with the standard or tool used for each.
- Policies, either included or referenced.
- Roles and responsibilities for staff, management, and the IT provider.
- Training program and records location.
- Vendor management: the list, agreements, and review schedule.
- Incident response plan with contacts, steps, and notification obligations.
- Backup and recovery plan with priorities and test schedule.
- Review and maintenance: the calendar and the change log.
Businesses covered by the FTC Safeguards Rule will recognize this as the structure of a compliant written information security program; our WISP compliance services produce it in that form.
Budgeting for the Cybersecurity Plan for Small Business Needs
A plan without a budget is a wish. Once the risk assessment ranks the gaps, the cybersecurity plan for small business operations should state what closing each one costs and when it will happen. For most New Jersey firms already on Microsoft 365 Business Premium with business-class devices, the largest items are configuration labor rather than new licenses: MFA and Conditional Access, device management, logging, and sharing restrictions are included in what you pay for.
The genuine additions are typically endpoint detection and response with monitoring, independent Microsoft 365 backup, a security awareness training platform, and the professional time to write and maintain the plan. Spread across a year, these are small relative to a single week of downtime, and they are what insurers now require. Our articles on the small business IT budget checklist and how to reduce IT costs for small business show where security fits in the overall numbers.
Small Business Security Policy Essentials: What Each Policy Should Say
Because the policy set is the part of cybersecurity planning most owners have never written, here is what each core small business security policy should cover, in a paragraph or two each:
- Acceptable use: company systems are for business, personal use limits, no unapproved software or cloud services, no sharing of accounts.
- Authentication: MFA required, password manager required, no password reuse, never share codes, report unexpected MFA prompts.
- Devices and remote work: company-managed devices only for company data, encryption required, screen locks, home network minimums, lost-device reporting within the hour.
- Data handling: what counts as sensitive, where it may be stored, how it may be shared (portal, not email), printing and shredding rules, retention and disposal schedule.
- Access control: least privilege, approval for access changes, quarterly reviews, same-day removal at departure.
- Vendor management: security review before onboarding, required contract terms (BAA, DPA, security obligations), annual re-review.
- AI use: approved tools and accounts, prohibited data, human review of outputs. See our guide on how to prevent AI data leaks.
- Incident response: how to report, who leads, isolation steps, notification obligations, no-blame reporting.
Each small business security policy should be dated, acknowledged by every employee, and reviewed with the rest of the cybersecurity plan for small business operations annually.
Cybersecurity Planning for Regulated New Jersey Businesses
Medical and dental practices
The HIPAA Security Rule requires a risk analysis, policies and procedures, workforce training, a contingency plan, and a named Security Officer, and the proposed update would make MFA and encryption mandatory. A cybersecurity plan for small business practices built on the outline above satisfies those requirements when it is specific to the practice’s systems. Our HIPAA compliance consulting team builds it that way.
Accounting, tax, and financial services
The FTC Safeguards Rule requires the written program, the Qualified Individual, MFA, encryption, monitoring, vendor oversight, an incident response plan, and an annual report. The IRS requires tax professionals to have a WISP. See our guides to the FTC Safeguards Rule requirements and the FTC Safeguards Rule for tax preparers.
Law firms
Rules of professional conduct require reasonable efforts to protect client information, and a cybersecurity plan for small business law practices is the clearest evidence of those efforts. Clients, particularly corporate and institutional ones, require evidence. A documented plan answers both. See IT support for law firms.
Everyone else
The New Jersey Data Privacy Act, the state breach notification law, PCI DSS for card acceptance, and your cyber insurance application all expect documented security. Our guide to which NJ regulations apply to your business sorts out the thresholds.
Choosing a Partner for Cybersecurity Planning
Most small businesses do not write their first cybersecurity plan for small business operations alone, and the original version of this article recommended partnering with a cybersecurity provider. The advice stands, with sharper questions to ask:
- Do they produce the written plan and policies, or only install tools?
- Which frameworks and regulations do they work in, and can they show a sample plan for your industry?
- Will they serve as or support the Qualified Individual or Security Officer role?
- How do they handle incident response, and what are the response-time commitments?
- What monitoring, backup, and training do they include, and what is extra?
- How often will they review the plan with you, and what will the annual report look like?
- Can they provide references from similar New Jersey businesses?
Our cybersecurity services and cybersecurity assessment pages describe how eMDTec answers those questions.
Keeping the Plan Alive: A 12-Month Calendar
The last tip in the 2023 version of this article was to update the plan regularly. Here is what “regularly” looks like in practice for a cybersecurity plan for small business operations:
- Monthly: review security alerts and patch status with your IT provider; confirm backups completed and a test restore succeeded.
- Quarterly: access review (who has what, who has left), license and vendor review, phishing simulation results, and a check that new systems or apps were added to the inventory.
- Semiannually: vulnerability scan; review of Conditional Access and sharing settings against the baseline.
- Annually: full risk assessment, policy revision and re-acknowledgment, staff training, tabletop exercise, penetration test where required, cyber insurance application review, and the written report to ownership.
- After any change or incident: update the affected sections immediately and note the revision.
A managed IT provider typically runs this calendar as part of service, which is what turns cybersecurity planning from an annual scramble into a routine. Our monthly IT maintenance checklist covers the operational side.
Common Cybersecurity Planning Mistakes
- Downloading a cybersecurity plan for small business template, changing the company name, and filing it away. Auditors and insurers compare the plan to reality.
- Treating the cybersecurity plan for small business operations as an IT document rather than a business document. Ownership belongs with management.
- Planning for every exotic threat and skipping the common ones. Phishing, stolen passwords, and unpatched remote access cause most small business incidents.
- Writing an incident response plan that lives only on the server that will be encrypted.
- Never testing backups or rehearsing the response.
- Letting the plan go stale. A plan last revised in 2023 does not mention AI tools, passkeys, or the current notification rules.
Cybersecurity Plan for Small Business: Frequently Asked Questions
How long does it take to create a cybersecurity plan?
With an experienced partner, the inventory, risk assessment, and first version of the cybersecurity plan for small business use typically take four to eight weeks for a small business, with technical gaps closed in parallel.
Is a cybersecurity plan the same as a WISP?
A WISP, or written information security program, is the form a cybersecurity plan takes under the FTC Safeguards Rule and IRS guidance. The content is the same; the term is specific to those requirements.
What does a cybersecurity plan cost?
A cybersecurity plan for small business owners is a modest professional services engagement to write. Most of the spending, if any, goes to closing gaps the assessment finds, such as MFA enforcement, EDR, or backup, which are usually required by insurers and regulators regardless.
How often should the plan be updated?
A cybersecurity plan for small business use should be fully reviewed once a year and after any significant change: a new system, a merger or move, a breach, or a new regulation. Access, licenses, and vendors should be reviewed quarterly.
Will a cybersecurity plan lower our insurance premium?
A documented cybersecurity plan for small business coverage frequently helps, and more importantly it is increasingly a condition of coverage. Carriers want to see MFA, EDR, backups, training, and an incident response plan documented, all of which the plan contains.
Start Your Cybersecurity Plan With a Risk Assessment
A cybersecurity plan for small business owners is the document that turns scattered tools and good intentions into something you can defend to an insurer, a regulator, a client, and yourself after an incident. eMDTec has written and maintained these plans for New Jersey medical practices, law firms, accounting firms, and professional services businesses since 2002, as part of our managed IT services. Schedule a free consultation and we will start with the risk assessment that every good plan is built on.