Short answer: a small business is reasonably protected when eight controls are in place: multi-factor authentication on email and remote access, scheduled patching, managed endpoint protection on every device, email filtering with an external-sender banner, tested backups kept separate from the network, full-disk encryption on laptops, a business-grade firewall with the guest Wi-Fi separated, and a short phishing briefing for staff each quarter. None of these is expensive. Most Portland offices we visit for the first time are missing three or four of them.
First published in 2016, rewritten October 2026. The eight controls below replace the older advice on this page and on three retired posts that now point here.
| Control | What “done” looks like | Typical cost for 10 users |
|---|---|---|
| 1. MFA | Authenticator app or passkey on every mailbox, admin account, bank, VPN | Included with Microsoft 365 / Google |
| 2. Patching | Windows, macOS, browsers and apps updated on a schedule, verified by a report | Part of managed IT |
| 3. Endpoint protection | Managed EDR/antivirus on every PC and server, alerts go to someone | A few dollars per device per month |
| 4. Email filtering | Spam/phishing filter plus a visible “external sender” banner | Included or a few dollars per mailbox |
| 5. Backups | Daily, off-network copy of servers, files and Microsoft 365; restore tested quarterly | Tens of dollars per month |
| 6. Encryption | BitLocker (Windows) or FileVault (Mac) on every laptop and desktop | Free |
| 7. Firewall and Wi-Fi | Business-grade firewall, guest Wi-Fi on its own network, firmware current | A few hundred dollars once |
| 8. People | 30-minute phishing briefing per quarter, a simulated phish, a “when in doubt, forward it” rule | Staff time |
How do small businesses actually get breached?
Not by sophisticated attacks. The FBI’s 2024 Internet Crime Report counted $16.6 billion in reported losses, and the biggest business category was email impersonation (business email compromise) at $2.77 billion, which needs no malware at all: one stolen or guessed password, or one convincing email. Ransomware usually arrives the same way, through a phished login or an unpatched machine exposed to the internet. The eight controls map directly onto those paths.
1. Multi-factor authentication: why is it first?
Because a stolen password with MFA turned on usually gets the attacker nothing. Use an authenticator app or passkey; the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ranks text-message codes as the weakest option. Detail in our password and MFA guide.
2. Patching: do updates really matter that much?
Yes. A large share of ransomware incidents start with a known, already-fixed vulnerability on a machine that never installed the fix. “Updates install themselves” is true until a PC is left asleep, a reboot is postponed for a month, or a line-of-business app blocks the update. Patching needs a schedule and a report that shows what is still missing. That report is the difference between hoping and knowing.
3. Endpoint protection: is Windows Defender enough?
Defender is a capable engine. The gap is management: who sees the alert at 2 AM, who isolates the machine, who checks that protection is on everywhere. Managed endpoint detection and response (EDR) adds that layer and is priced per device. For a business with no IT staff, the management is the product.
4. Email filtering: what should it do?
Block the obvious, quarantine the suspicious, and stamp every message from outside the company with a visible banner. The banner is the cheapest security control there is: “the boss” asking for gift cards from an external address looks very different with “EXTERNAL” above it. Both Microsoft 365 and Google Workspace can do this with a few settings.
5. Backups: what counts as a real backup?
A copy that is automatic, daily, stored somewhere ransomware on your network cannot reach, and restored on purpose at least once a quarter to prove it works. A USB drive on the desk fails the second test; a synced OneDrive fails the third (it syncs the encrypted files too). Microsoft 365 itself is not a backup, which this post explains. See data backup and recovery.
6. Encryption: why does a stolen laptop matter?
Because under Maine’s breach law a stolen laptop with customer records can start a 30-day notification clock, and an encrypted one generally does not. BitLocker and FileVault are built in and free. Turn them on, record the recovery keys in the password manager, done.
7. Firewall and Wi-Fi: what is wrong with the router the ISP gave us?
It is a consumer device with consumer defaults, no security updates after a couple of years, and one flat network where the guest Wi-Fi, the printer and the accounting PC all sit together. A business-grade firewall with a separate guest network, current firmware and remote access turned off is a few hundred dollars and lasts years. Our Wi-Fi guide covers the design.
8. People: how much training is enough?
Thirty minutes a quarter, with real examples and a practice phishing email, plus one standing rule: any request for money, bank details or passwords gets a phone call to a known number. Here is the plan.
What about antivirus on phones, VPNs, and cyber insurance?
Phones: keep them updated, use a screen lock, and put company email in a managed app if staff use personal phones. VPNs: useful for remote workers reaching an office server; not a substitute for anything above. Cyber insurance: increasingly requires controls 1, 3 and 5 as a condition of coverage, so doing them is also how you keep the policy.
Frequently asked questions
How much does all of this cost for a 10-person office?
Most of it is included in Microsoft 365 or Google Workspace and in a managed IT fee. Standalone, expect a few dollars per device per month for endpoint protection and backup, and a one-time few hundred dollars for a firewall. See what IT support costs in Maine.
We are tiny. Are we really a target?
Attackers do not pick targets by size; automated tools scan everything and phishing goes to everyone. Small businesses are hit because they are easier, not because they are chosen.
Where should we start if we can only do one thing this week?
MFA on every mailbox. Then backups. Then the external-sender banner.
Do these controls satisfy HIPAA, CMMC or our insurer?
They are the foundation every framework assumes. HIPAA and CMMC add documentation, logging and policies on top. An insurer’s questionnaire usually asks about exactly these eight.
Sources
- FBI Internet Crime Complaint Center, 2024 Internet Crime Report (April 2025): $16.6 billion reported losses; BEC $2.77 billion
- CISA, Implementing Phishing-Resistant MFA: cisa.gov
- Maine Revised Statutes Title 10 ยง1348, security breach notice requirements: legislature.maine.gov
Cite this page: “The Small Business Security Baseline: 8 Controls Every Maine Office Needs”, Information Systems of Maine, Portland, ME, updated October 2026.
Want to know which of the eight you are missing? Request a free evaluation or call 207-653-4143. We serve Portland, South Portland, Westbrook, Scarborough, Cape Elizabeth, Gorham and businesses across Cumberland, York, Androscoggin and Kennebec counties.
