The Security Basics a Small Shop Can't Skip
Why this matters
Moving your shop into software changed your risk in a way paper never did. On paper, a thief had to break into the building and haul out a filing cabinet. Now one leaked password can open your whole business from anywhere in the world, one bad click can lock every record at once, and your data and your access depend on accounts and a vendor you do not fully control. You do not need an IT department to cover the floor. You need a short list of locks that are non-negotiable the moment your business lives behind a login. Everything else in security is improvement on top of these.
The non-negotiables, and what each one stops
This is the floor. Each row is a lock you do not leave off, the disaster it prevents, and why going digital made it newly critical.
| Lock | The disaster it prevents | Why it is newly critical |
|---|---|---|
| Two-factor on the key accounts | A stolen password alone opening email, bank, payments, and your customer system | One password now reaches everything from anywhere; a second proof makes a stolen one useless |
| One person, one login | No way to tell who did what, and no clean way to cut off one person | Shared logins mean a departure either locks out the crew or leaves a door open |
| A recovery path you control | Getting permanently locked out of your own accounts | Access now depends on a reset email or phone; if a former employee holds it, they hold you |
| Your own data backup | Losing everything to a mistake, a lockout, or a vendor event | The vendor backs up their system, not your data or your errors |
| Lock every phone and laptop | A lost device becoming a full breach of customer homes | Field devices now carry addresses, gate codes, and card-on-file access |
| Verify money changes out of band | Wiring funds to a scammer who spoofed a supplier or the owner | Payment changes now arrive by email, the easiest thing to fake |
Two-factor (a password plus a one-time code, usually on your phone) on the key accounts is the single highest-payback item here. If you do one thing this week, do that.
The master-key problem
Paper had no master key. Digital does: your email. Whoever controls your email can reset the password on nearly every other account, because that is where the reset links go. Treat the email account that anchors your logins as the crown jewel, with the strongest protection, two-factor on, and a recovery path only the business controls. Protect the bank, the payment processor, and your customer system at the same level. These few accounts are worth more of your attention than every other login combined.
Know how you get back in
The security step shops never rehearse is recovery. Before you are locked out, know the answer to one question: if you lost your phone or forgot the password on your most important account tomorrow, could you get back in today. That means saving the backup codes the account gives you, keeping the recovery email and phone current and owned by the business, and never leaving a former employee as the recovery contact. A lockout with no recovery path is self-inflicted and permanent.
The vendor's security is now part of yours
When your records live in someone else's software, their security failures become your incident. You cannot audit them, but you can choose well and ask the few questions that matter: does the provider offer two-factor for your account, do they encrypt your data, will they tell you if they are breached, and can you export your data if you leave. A shop with careful habits and a careless vendor is only as safe as the vendor's worst day.
The mental model to keep
You are not trying to beat a targeted, determined hacker. You are trying to not be the easy one. The locks above are cheap, and the attacks that ruin small shops are cheap and automated, so cheap defenses stop most of them. Turn on two-factor, give everyone their own login, own your recovery path, keep your own backup, lock the devices, and verify money changes with a phone call. Do the floor and almost all the damage never reaches you.
References
- Cybersecurity and Infrastructure Security Agency (CISA), cyber basics for small business
- Federal Trade Commission (FTC), small business cybersecurity and protecting personal information
- See related: Cybersecurity Basics for a Small Shop; Small Business Cybersecurity; The Customer Data You Store: Protecting It; The Data Backup Habit That Saves a Shop From Disaster