How do I write a one-page security plan for my business?
Write one page that names who's in charge, lists the accounts, devices and vendors you depend on, sets five or six rules everyone follows, and says who to call when something goes wrong. NIST's Cybersecurity Framework 2.0 gives the structure. Review it every six months and after any incident.
The short version
- One owner. Name the person responsible, and a backup.
- One list. Every account, device and vendor the business depends on.
- A few rules. Passkeys or two-step login, a password manager, updates on, payment changes confirmed by phone, backups tested.
- One phone tree. Who to call for a hacked account, a payment scam, a site problem or a lost laptop.
- One review date. Every six months, and after anything goes wrong.
Why one page?
A plan nobody reads doesn’t help. One page fits on the office wall and in everyone’s head. CISA’s Secure Your Business page asks small businesses to get the essentials right first, then add an incident response plan exercised at least once a year. This page is both.
How is it structured?
NIST’s Cybersecurity Framework 2.0, published in February 2024, groups security into six functions. Its Small Business Quick-Start Guide explains each for a small firm. Use them as your six headings.
| Function | The question it answers | What goes on your page |
|---|---|---|
| Govern | Who decides, and what matters most? | Owner, backup, what you must protect |
| Identify | What do we have? | Accounts, devices, vendors, data |
| Protect | How do we keep it safe? | Your five or six rules |
| Detect | How would we know? | Alerts and warning signs |
| Respond | What do we do? | Phone tree, first steps |
| Recover | How do we get back? | Backups and who restores them |
How do I fill it in?
1. Govern
Write the name of the person in charge of security, and their backup. In a small business this is usually the owner. Then write the three things it would hurt most to lose, for example: “customer payment details, our email, the booking system.”
2. Identify
List, on a separate sheet if needed:
- Accounts: email, bank, domain registrar, website, hosting, accounting, payroll, Google Business Profile, social media.
- Devices: every computer, phone and tablet that opens business email, plus the router.
- Vendors: anyone with access, like your web company, IT person, bookkeeper or software providers.
For each account, note who owns it. It should be the business, not one person. Our article on owning your online accounts shows how.
3. Protect
Pick five or six rules. These come from CISA’s four essentials (phishing awareness, strong passwords, multifactor authentication, updates) plus two that matter most for small firms:
- Everyone uses the business password manager. See rolling out a password manager.
- Passkeys or two-step login on email, banking, the domain and the website. See passkeys.
- Updates install automatically on every device. See devices and Wi-Fi.
- New or changed payment details are confirmed by phone on a known number. See business email compromise.
- Backups run daily, one copy is out of reach, and we test a restore every quarter. See backups and ransomware.
- Vendors get their own login and lose it when the job ends. See vendor access.
4. Detect
Write down what you’d notice: sign-in alerts from Microsoft or Google, bank alerts, website monitoring emails, customers saying they got odd emails from you. Make sure each alert goes to an inbox someone reads.
5. Respond
A phone tree, with real numbers:
- Bank fraud line, for any payment scam.
- Your IT or email provider, for a hacked account.
- Your web company, for a website problem.
- Your insurer’s breach line, if you have cyber insurance.
- Where to report: ic3.gov for fraud, and cisa.gov/report for attacks on your systems.
Then link the first steps: the first hour after an account takeover and what to do after a data breach.
6. Recover
Where are the backups, who can restore them, and when did you last test one?
What are the common mistakes?
- Copying a template with rules you don’t follow. Write only what you’ll do.
- Keeping it on the computer that might be locked by ransomware. Print a copy.
- Phone numbers only in email. If your email is taken over, you can’t look them up. Put them on paper.
- No review date. Staff, vendors and accounts change. The plan should too.
- Leaving out the website. It holds forms and logins too. See what not to touch in WordPress and our WordPress security article.
What if we don’t have time for all of it?
Do the Protect rules first, especially two-step login on email and the payment-change rule. Those two stop most of the expensive problems small businesses face. CISA’s Cyber Essentials Starter Kit is a good next read when you have time.
How long does it take?
An afternoon to write the first version. Thirty minutes every six months to review it. A short practice run, like “what would we do if the bookkeeper’s email was hacked,” takes under an hour and finds the gaps.
How does E-3 handle this?
For websites we look after through website care, we cover the website lines of the plan: tested updates, daily backups, security alerts and monitoring for known plugin vulnerabilities. Accounts we set up are in the client’s name, with E-3 added as a user, so they belong on your Identify list under your business.
Related questions
Next step
- Next: How do I stop invoice scams and wire fraud by email?The next guide in Cybersecurity basics.
- Website careUptime monitoring, tested updates, daily backups and security alerts.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled cybersecurity basics for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.