Practical guide · cert.gt
Basic security for small businesses
Version 1.0 · Reviewed Oct 11, 2026 · TLP:CLEAR · For: Owners and managers of small businesses.
Ten low-cost measures that stop most attacks against small businesses. You do not need an IT department: you need one person in charge, an afternoon to set them up and the discipline to keep them going.
The ten measures
| 1. Two-step verification | Turn it on for email, online banking, the business's social media accounts and WhatsApp. It is the measure that stops the most attacks. |
|---|---|
| 2. Unique passwords | A different one for each service, stored in a password manager. Never on a note stuck to the monitor. |
| 3. Automatic updates | On computers, phones, the router and the invoicing system. A device that is no longer supported must be replaced. |
| 4. Backups | An automatic daily copy of what you cannot afford to lose, with one disconnected copy. Test a restore every three months. |
| 5. One account per person | No shared users and no administrator permissions for everyday work. Delete the account when someone leaves. |
| 6. Antivirus and firewall | The one that comes with the operating system is enough if it is turned on and up to date. |
| 7. Separate Wi-Fi | One network for the business and another for customers and visitors. Change the router's factory-default password. |
| 8. Verify payments through another channel | Every change to a supplier's bank account is confirmed by phone, on a number you already knew. |
| 9. Train the team | Fifteen minutes every quarter: how to recognize a fake email and who to tell. |
| 10. Know what to do if it happens | A printed sheet with the steps and the phone numbers: bank, IT provider, cert.gt. |
If you can only do three
- Two-step verification on email and banking.
- Automatic backups with one disconnected copy.
- Automatic updates on all devices.
Warning signs
- An email that pressures you to pay, sign in or download something.
- A supplier that tells you by email that its bank account has changed.
- Someone asking for a code you received by SMS.
- A computer that suddenly runs very slowly or shows windows you did not open.
If something goes wrong
- Disconnect the affected device from the internet, without turning it off.
- Change your passwords from another device.
- Call your bank if money is involved.
- Report the incident at cert.gt/reportar: it is free and you will receive guidance.
Official text
Based on Implementation Group 1 of the CIS Controls and on the NIST CSF 2.0 guide for small businesses.