09/21/2026
At the very least, small businesses should have the following protocols in place:
• Multi-factor authentication (MFA) is enabled for all remote access to the network, including all Remote Desktop Protocol (RDP) connections.
• Multi-factor authentication (MFA) is enabled for all email accounts.
• MFA is enforced for all privileged / administrator accounts, both local and remote.
• Critical security patches and updates are applied promptly; no end-of-life or unsupported software is in use.
• All endpoints (desktops, laptops, servers) are protected with anti-virus, anti-malware, or endpoint detection software.
• Remote access to the network is only permitted via a VPN or equivalent secure connection.
• Incoming emails are scanned for malicious attachments and links.
• A firewall is in place at the network perimeter.
• User access rights are restricted to the minimum necessary for each role (principle of least privilege).
• Security awareness training is provided to all employees at least annually.