[{"data":1,"prerenderedAt":61},["ShallowReactive",2],{"watch-small-business-cybersecurity-start-with-the-work":3},{"id":4,"title":5,"author":6,"blogbody":7,"body":8,"category":15,"ctaLabel":16,"ctaUrl":17,"date":18,"description":19,"extension":20,"featured":21,"image":22,"lastReviewed":18,"meta":23,"navigation":24,"outboundlinks":25,"path":26,"reviewStatus":27,"seo":28,"seoTitle":29,"sources":30,"stem":46,"tags":47,"videos":52,"youtubelinks":25,"__hash__":60},"blog\u002Fblog\u002Fsmall-business-cybersecurity-start-with-the-work.md","Start Small Business Cybersecurity With the Work, Not the Tool List","Nick DiVito","## Executive summary\n\nYou have multifactor authentication, backups, security software, and an IT provider. Those are useful things to have.\n\nThey are not the same as knowing the business can keep taking orders, paying the right people, accessing its accounts, and recovering after something goes wrong.\n\nThe gap usually appears between the reassuring statement and the actual task. \"We have backups\" becomes \"I think the provider can restore that application.\" \"We use multifactor authentication\" becomes \"I think the owner has the recovery codes.\" Nobody necessarily lied. The conversation stopped before anyone checked the dependency.\n\nReverse the order. Pick one important job, describe a plausible interruption, and follow the response until someone reaches an assumption. Verify that assumption safely with the responsible person. Then decide whether the missing piece is a setting, a responsibility, an agreement, or an actual new capability.\n\nThat sequence protects the next security dollar from solving the wrong problem.\n\n## A control can work while the business outcome fails\n\nConsider an illustrative supplier-payment workflow. The bookkeeper receives new payment instructions from a genuine supplier email account. The account belongs to the supplier, the message follows an existing conversation, and the wording fits the job.\n\nAn attacker who controls that mailbox does not need to send an obviously fake address. The [FBI's Internet Crime Complaint Center](https:\u002F\u002Fwww.ic3.gov\u002FCrimeInfo\u002FBEC) describes business email compromise involving legitimate business accounts. Recognizing familiar spelling and a familiar sender is therefore not enough to authorize a changed destination for money.\n\nYour email defenses may operate as configured while the bookkeeper still acts on a fraudulent instruction. The business needs a separate rule for verifying changes through a known, independently obtained contact route. The phone number in the suspicious message is not independent verification.\n\nAsk the bookkeeper to walk through a fictional change request without changing a real payee or sending money. Where would they find the trusted number? Who can approve the change? What happens when that person is absent? Where does the verification record go?\n\nThose questions reveal whether the workflow works under pressure. A screenshot showing email protection enabled cannot answer them.\n\n## Four operating questions make the discussion concrete\n\nAt Trawvid Sec, we organize the owner conversation around Work, Money, Recovery, and Ownership. These are practical prompts, not a certification standard or a substitute for a full security program.\n\n**Work:** Which job stops when a particular account, device, file, or provider becomes unavailable? Start with a real activity such as dispatching a technician, processing payroll, or releasing a customer order.\n\n**Money:** Who can change where money goes, and what independent approval stands between a convincing request and the transaction? Include refunds, payroll changes, and vendor bank details rather than discussing only wires.\n\n**Recovery:** How does an authorized person regain usable access and restore the task? Account recovery, data restoration, and continuing work during an interruption are related but different jobs.\n\n**Ownership:** Who makes the decision, who performs the work, and who checks the result? A provider can operate technology without owning the company's priorities or approval rules.\n\nThe broader [NIST Cybersecurity Framework resources for small businesses](https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fsmallbusinesscyber\u002Fnist-cybersecurity-framework-0) cover governance alongside protection, detection, response, and recovery. A useful owner discussion should likewise extend beyond whether a product exists. Keep the framework proportional to the decision rather than turning it into a new vocabulary test for staff.\n\n## Multifactor authentication does not answer the recovery question\n\nMultifactor authentication adds a verification requirement to sign-in. Keep it. The mistake is assuming that enabling it also resolves every way an account can be reset, recovered, or administered.\n\nAsk who can replace an authentication method, reset a password, change recovery details, or persuade support to restore access. Then ask what happens when the normal administrator's phone is unavailable. Both unauthorized recovery and impossible legitimate recovery can hurt the business.\n\nTrace the dependencies without exposing secrets. A record can name the service, authorized recovery role, approved method, storage location reference, and last verification date. It should not contain the passwords or recovery codes themselves.\n\nFor Microsoft cloud administrators, [Microsoft's emergency-access guidance](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fsecurity-emergency-access) describes separately protected emergency access, strong authentication, monitoring, and validation. This is not a recommendation to turn off authentication or give every owner a broadly privileged daily account. Have the responsible administrator implement the product-specific arrangement and demonstrate its intended use safely.\n\nWatch for circular recovery: the instructions sit in the inaccessible account, the backup code sits on the lost phone, or the alternate approver depends on the same unavailable provider. Another account is not truly an alternative when it fails for the same reason.\n\n## A successful backup is evidence of a backup job\n\nIt is not yet evidence that employees can resume work.\n\nChoose a task and describe what usable recovery would mean. For a service business, that might include retrieving an approved test work order, seeing its current status, accessing the relevant attachments, and recording a completion without corrupting live customer information.\n\nThe application may depend on licenses, identity services, configuration, network access, and someone authorized to restore it. A folder of recovered files may not include those dependencies. A synchronized copy may also reflect an unwanted change rather than preserve the version you need.\n\nAsk the provider to propose a safe test environment and acceptance check. The [NIST NCCoE recovery project](https:\u002F\u002Fwww.nccoe.nist.gov\u002Fdata-integrity-recovering-ransomware-and-other-destructive-events) emphasizes confidence in recovered data, not mere availability. Your business test should establish that the relevant information and task make sense, within the limits of the exercise.\n\nRecord what you tested, when, who observed it, how long the tested operation took, and what remained outside scope. Do not turn one file restore into a promise about the whole company's recovery time. The limitation belongs beside the successful result, not hidden in an email nobody will find later.\n\n## Your provider cannot infer decisions you never made\n\nA good IT provider can still operate under an incomplete brief.\n\n\"Keep us secure\" does not establish which employee may approve a new administrator, how much interruption the business accepts, whether after-hours response is included, or which application the company must restore first. Those are service and business decisions, not just technical settings.\n\nOpen the agreement with the provider. Identify the systems and activities it covers, the ones it excludes, the alert recipient, the response hours, and the business approval contact. Confirm how the company obtains account, license, configuration, and recovery information when the relationship ends.\n\nWritten expectations and verification belong together. The [FTC's small-business vendor guidance](https:\u002F\u002Fwww.ftc.gov\u002Fbusiness-guidance\u002Fsmall-businesses\u002Fcybersecurity) addresses both. A contract establishes the agreement; a relevant demonstration or record shows how the arrangement operates.\n\nDo not use this as an excuse to demand every password by email or remove your provider's access without a transition. Business ownership means the company can authorize and sustain its operations through an appropriate arrangement. It does not require the owner to perform every administrative task personally.\n\nOur [IT Provider and Vendor Security guide](\u002Fresources\u002Fsmall-business-vendor-it-provider-security) gives you working questions and records for that discussion.\n\n## Choose one bad day and follow the work\n\nBring together the person responsible for the job, the business decision-maker, and the relevant technical contact. Pick one scenario with a recognizable consequence: a lost administrator phone, an unavailable order system, or a supplier's changed bank instructions.\n\nKeep the scenario small enough to follow from start to finish. A dramatic exercise that combines ransomware, a building outage, and three absent executives will create plenty of discussion without telling you which assumption to address first.\n\nAsk what happens next. Then ask who does it, where they get the information, and what would show that it worked. Continue until an answer depends on \"I think,\" \"probably,\" or \"the provider handles that.\"\n\nThat is the stopping point for the first verification task, not a reason to embarrass the person who answered. The uncertainty is useful information.\n\nCapture it in a compact record:\n\n| Current claim | Business question | Evidence to check | Remaining limit | Decision owner |\n| --- | --- | --- | --- | --- |\n| The provider has recovery access | Can an authorized alternate restore access when the usual administrator is unavailable? | Approved recovery procedure and arranged demonstration | Other services not yet tested | Owner and technical lead |\n| Backups run nightly | Can staff complete the selected task with restored information? | Controlled restore and task acceptance record | Full-site recovery not tested | Operations lead |\n| Staff verify payments | Can the substitute approver find an independent contact route? | Fictional change-request walkthrough | No live payment test | Finance lead |\n\nStore the record where the responsible people can find it. It should point to evidence, not collect secrets.\n\n## A safe demonstration is better than a surprise test\n\nDo not disable a production account, unplug a network, send a deceptive message to staff, or make a real payment merely to prove a point in this exercise.\n\nAgree the scope, test accounts or sample data, approvals, timing, and stopping conditions with the administrator. A document walkthrough may be the right first step. A controlled technical test can follow when the responsible people can manage its effects.\n\nSeparate three levels of confidence. A provider's explanation tells you the intended process. A current configuration record shows what appears to be set up. A controlled demonstration shows what happened under particular conditions. Each is useful, but none should pretend to be the others.\n\nWhen a result surprises you, preserve the observation and ask what explains it before changing settings. A failed test might reveal an expired license, missing permission, unsupported feature, or misunderstanding of the scope. Buying something new before finding the cause risks preserving the same problem under another brand.\n\nThis is practical verification, not an unauthorized penetration test or a full audit.\n\n## Fix the failed handoff before adding another subscription\n\nClassify what the exercise found.\n\nAn existing feature may need configuration. A person may need authority or instruction. The agreement may omit a task. A recovery path may depend on the wrong account. Sometimes the business really does lack the necessary technology or specialist capacity.\n\nThose findings lead to different purchases, and several may require no new product at all. Do not ask an employee to compensate indefinitely for a feature the business genuinely needs. Equally, do not purchase a platform to avoid naming who approves a payment change.\n\nFor any proposed tool, define the job it adds, the person who operates it, the ongoing cost, the evidence of success, and what it replaces. Include the effort to remove the old arrangement and transfer useful records. Otherwise the new purchase may simply add another renewal and another console nobody owns.\n\nThe [Cost of Cyber Confusion guide](\u002Fresources\u002Fsmall-business-cyber-cost-of-confusion) provides a way to connect those decisions with interrupted work and wasted effort without borrowing someone else's breach-cost headline.\n\n## Keep the evidence useful after the meeting\n\nAssign the next action to a person who can actually complete it. Define the result in operational terms, not \"improve security.\" For example: arrange a supported recovery demonstration, confirm the alternate approval route, or document the application's exclusions in the provider agreement.\n\nReview the result and close the assumption only as far as the evidence supports. Set a sensible revisit trigger, such as an administrator departure, provider change, major application change, or failed recovery test. A record that was accurate last year may no longer describe today's account dependencies.\n\nYou do not need to settle every security question before making progress. You do need to know which question the next piece of work answers. That is how a small business avoids a growing tool list with no corresponding increase in usable capability.\n\n## Put the business outcome at the front of the conversation\n\nStart with one important job and the first assumption you cannot support. Keep the safeguards that work. Repair the missing permission, recovery path, responsibility, or capability rather than treating uncertainty as a reason to buy everything.\n\nThe [Cyber Hygiene Checkup](\u002Fsmall-business-cyber-resilience) examines those connections across Work, Money, Recovery, and Ownership. [Book a conversation with Trawvid Sec](https:\u002F\u002Fcalendar.app.google\u002FqT8vtwaEDG2Pt51o8) to bring the accounts, providers, and decisions behind your operations into the same discussion. We challenge the assumptions before another renewal or interruption forces the decision for you.",{"type":9,"value":10,"toc":11},"minimark",[],{"title":12,"searchDepth":13,"depth":13,"links":14},"",2,[],"Security Program","Discuss the work your business must keep doing","https:\u002F\u002Fcalendar.app.google\u002FqT8vtwaEDG2Pt51o8","2026-10-20","Test the assumptions behind accounts, payments, backups, and your IT provider. Connect security spending to the work your business must keep doing.","md",false,"\u002Fimg\u002Fblog\u002Fblog-small-business-cyber.jpg",{},true,null,"\u002Fblog\u002Fsmall-business-cybersecurity-start-with-the-work","Current",{"title":5,"description":19},"Small Business Cybersecurity: Test the Work Before Buying More",[31,34,37,40,43],{"label":32,"url":33},"NIST Cybersecurity Framework resources for small businesses","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fsmallbusinesscyber\u002Fnist-cybersecurity-framework-0",{"label":35,"url":36},"FBI IC3 business email compromise guidance","https:\u002F\u002Fwww.ic3.gov\u002FCrimeInfo\u002FBEC",{"label":38,"url":39},"Microsoft Entra emergency-access account guidance","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fsecurity-emergency-access",{"label":41,"url":42},"NIST NCCoE recovery and data-integrity project","https:\u002F\u002Fwww.nccoe.nist.gov\u002Fdata-integrity-recovering-ransomware-and-other-destructive-events",{"label":44,"url":45},"FTC small-business cybersecurity and vendor guidance","https:\u002F\u002Fwww.ftc.gov\u002Fbusiness-guidance\u002Fsmall-businesses\u002Fcybersecurity","blog\u002Fsmall-business-cybersecurity-start-with-the-work",[48,49,50,51],"Small business","Cyber hygiene","Vendor review","Account recovery",[53],{"title":54,"url":55,"description":56,"uploadDate":57,"duration":58,"thumbnailUrl":59,"watchPage":24},"Your Small Business Is Doing Cybersecurity Backwards","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=rQuhzYqoSbg","Nick DiVito follows the assumptions behind payments, multifactor authentication, backups, and IT providers, then demonstrates an owner exercise for connecting safeguards to business operations.","2026-08-14T19:13:28-05:00","PT13M43S","https:\u002F\u002Fi.ytimg.com\u002Fvi\u002FrQuhzYqoSbg\u002Fhqdefault.jpg","Y6_tfFhQiiCuh6dHyTc-Wf6T8lO-0gWZDieCEnX731g",1792533899415]