Most of the security problems I clean up for small businesses in central Connecticut are not sophisticated. Nobody broke through a firewall. Someone clicked a fake Microsoft pop-up and let a "technician" into their computer. Someone's email password was the same one they used on a shopping site that got breached in 2019. A former employee's account was still active eight months after they left. A backup had been failing since spring and nobody was looking.
None of those need a security budget to prevent. They need a list and somebody who checks it. This is the list I work through with every new business client, whether they're a two-person office in Middletown or a 30-seat shop in Hartford County. For each item: what it is, how to check it yourself in about two minutes, and what it realistically costs.
If you do nothing else, do the first three.
1. Multi-factor authentication on email and anything that touches money
Email is the master key. Whoever controls your inbox can reset the password on your bank, your payroll, your QuickBooks and your vendor portals, and can send invoices to your customers with a different account number on them. That last one is the most common way Connecticut small businesses actually lose money to hackers, and it starts with one stolen email password.
How to check: on your phone, open a private browser window and sign in to your work email. If you get in with just a password, MFA is off. Do the same for your bank and payroll login.
What it costs: nothing. It is built into Microsoft 365, Google Workspace, and every bank. The only cost is 15 minutes per person to set up the authenticator app.
2. Business-grade antivirus on every computer, managed by someone
The free antivirus that came with the PC is better than nothing, and that is about all it is. What a business needs is one product on every machine, managed from one console, with an actual person who sees the alerts. When it catches something at 2 AM on the front desk computer, somebody should know by morning.
I wrote up the consumer brands in What is the best antivirus in 2026. For businesses we use Bitdefender GravityZone, but the brand matters less than two questions: is it on every computer, and who gets the alert?
How to check: ask whoever handles your IT what happened the last time the antivirus caught something. If the answer is "I'd have to look," nobody is looking.
What it costs: a few dollars per computer per month.
3. Backups with a date somebody can read
A backup you have not checked is a hope, not a backup. Every computer that holds anything you would miss, and definitely the server if you have one, should back up to somewhere off-site with version history, and somebody should be able to tell you the date of the last successful run without hunting for it.
Version history is the part people skip. If ransomware encrypts your files on Tuesday and your backup faithfully copies the encrypted versions Tuesday night, a backup without history has just saved you nothing. You need to be able to go back to Monday.
How to check: ask for the date of the last successful backup on your most important machine. Then ask someone to restore one file from last week. If either request takes more than a day, you do not have a working backup.
What it costs: a few dollars to about $15 per computer per month for business cloud backup, depending on how much data you have. A server is more.
4. Updates that actually install
"Automatic updates are on" is not the same as "updates are installing." About half the computers I take over from a previous setup have Windows updates silently failing, some for months. The machine looks fine. It is just missing every security fix since the failure started.
Two things to know for 2026. Windows 10 stopped getting security updates in October 2025, and I still find it running in offices every week. Those machines need to be upgraded or replaced, not "monitored." And updates are not just Windows. Browsers, Adobe, Zoom, QuickBooks and the remote access tool your accountant installed all need them too.
How to check: on each PC, press the Windows key, type winver, and hit Enter. If it says Windows 10, that machine is on the list. Then open Settings, Windows Update, and read the date next to "Last checked." If it is weeks old, updates are stuck.
What it costs: nothing for the updates. A Windows 10 machine that cannot run Windows 11 is a replacement, usually $600 to $900 for a business desktop.
5. Email authentication so nobody can send mail as you
SPF, DKIM and DMARC are three DNS records that tell the world which servers are allowed to send email from your domain. Without them, anyone can send a message that looks exactly like it came from you, to your customers, asking them to pay an invoice to a new account. With them set up properly, that message gets rejected or lands in spam.
Most small business domains I check have SPF, maybe DKIM, and no DMARC policy at all. The whole thing is about an hour of work for someone who has done it before.
How to check: search for "DMARC lookup," type in your domain, and see whether a record exists and whether its policy is "none," "quarantine" or "reject." "None" means it is only watching, not blocking.
What it costs: nothing but the hour.
6. Same-day offboarding when someone leaves
When an employee leaves, their email, their Microsoft or Google account, their VPN, their remote desktop access and any shared logins they knew should be shut off the same day. Not at the end of the week. I have found accounts for people who left years ago still active and still receiving mail, and in one case still able to reach the company file share.
The bigger version of this problem is the shared login. If the whole front office signs into one account, you cannot remove one person without changing it for everyone, so nobody does.
How to check: pull up the list of users in your Microsoft 365 or Google admin console and read the names. Anyone who does not work there anymore is a finding.
What it costs: nothing. It is a checklist item for whoever handles your IT, and it should be written down.
7. A password manager for the business
Reused passwords are how most email accounts get taken over. Someone uses the same password for work email and a retail site, the retail site gets breached, and the password shows up in a list that attackers run against Microsoft 365 logins automatically. A password manager fixes this by making every password different without anyone having to remember them, and it gives you a way to share the Wi-Fi password or the vendor portal login without a sticky note.
How to check: ask three people in the office whether their email password is also used anywhere else. Be ready for the answer.
What it costs: roughly $3 to $8 per user per month for a business plan from Bitwarden, 1Password or similar.
8. DNS filtering on the office network
Before a browser can load a bad website, it has to look up the address. DNS filtering puts a filter on that lookup, so links in phishing emails and the fake "your computer is infected" pages mostly fail to load at all. It stops a large share of problems before the antivirus ever has to get involved, and it protects the printer, the cameras and the phones as well as the computers.
How to check: this one is hard to see from the outside. Ask whoever set up your router what DNS the network uses. If the answer is "whatever Comcast or Frontier gave us," there is no filtering.
What it costs: free to a couple of dollars per month, and about 20 minutes on the router. Quad9 is free. We set it on every client network we manage.
9. Separate Wi-Fi for guests and gadgets
The security cameras, the smart TV in the waiting room, the thermostat, the credit card terminal and the visitor's phone should not be on the same network as the computer with your customer list on it. Those devices rarely get updates and are the easiest way into a small office network. A router from the last few years can run a separate guest network and a separate network for gadgets in a few clicks.
How to check: connect your phone to the guest Wi-Fi, if there is one, and try to open the shared drive or the printer's web page. If it works, the networks are not actually separate.
What it costs: nothing if the router supports it. A business-grade router that does is $150 to $400.
10. Nobody runs as an administrator
Almost every remote access scam I clean up required the victim to install something. If staff accounts on the office computers are standard users rather than administrators, that install prompts for a password the scammer does not have, and the call ends there. It also stops the toolbar junk and the "free PDF converter" that comes with three other programs.
How to check: on a staff PC, open Settings, Accounts, and look at the account type under the name. "Administrator" is a finding.
What it costs: nothing. Someone has to be reachable for the occasional legitimate install, which is what IT support is for.
11. A one-page plan for the first hour
When something does go wrong, the first hour decides whether it is an afternoon or a month. Every office should have a single page, printed, that says: unplug the network cable or turn off Wi-Fi, do not pay anyone, do not type any passwords on that machine, and here is who to call. I wrote the long version in Think your computer has been hacked? What to do in the first hour.
If you have cyber insurance, read the questionnaire you filled out to get it. It asks about nearly everything on this list, and a claim can be denied if the answers were not true at the time of the incident.
How to check: ask the person at the front desk what they would do if a pop-up said the computer was infected and gave a phone number. If the answer involves calling the number, you need the page.
What it costs: an hour to write and a sheet of paper.
12. A report that lists every computer
The last item is what makes the other eleven stick. Once a month, somebody should be able to hand you a list of every computer in the business with its Windows version, whether antivirus is on and current, the date of its last backup, and whether updates are installing. If nobody can produce that list, then nobody is watching, no matter what the invoice says. If the report you get is a page of green checkmarks and a "health score," read How to read a monthly IT report before you take it at face value.
How to check: ask for the list. The quality of the answer tells you most of what you need to know about your IT setup.
What it costs: it should be included in any managed IT arrangement. If you handle IT yourself, a spreadsheet you update monthly is better than nothing.
How to score yourself
Count how many of the twelve you can honestly check off today. In my experience a typical small Connecticut office that has never had managed IT scores four or five. That is not a judgment, it is just where things land when IT is handled by whoever is least busy.
If you are going to fix three things this month, make them MFA on email, verified backups, and getting every machine off Windows 10. Those three cover the ways small businesses most often lose real money. The rest can follow over a quarter.
For a ten-person office, the whole list costs roughly $100 to $250 a month in tools, plus whatever you pay for someone to run it. That is less than one hour of a lawyer's time, and considerably less than a week of nobody being able to work.
A note for Connecticut defense suppliers
If your shop does work for a prime contractor or the Department of Defense, this list is also most of what CMMC Level 1 asks for. The 17 Level 1 practices map almost directly onto items 1, 2, 4, 6, 9 and 10 above, plus some paperwork. If you have been asked for an SPRS score or a CMMC self-assessment, start with our CMMC compliance page and the plain-English SPRS guide.
Where we fit
CT Tech Express provides managed IT for small businesses across central Connecticut, owner-operated and month to month. Every item on this list is part of the standard setup, and the monthly report in item 12 is included. If you would rather handle IT yourself and just want to know where you stand, the free IT health report is an on-site look at your computers and network with a written summary, no software installed and no obligation. And if you are reading this because something already went wrong, the virus and malware cleanup page explains what to expect and what it costs.
Related reading: Managed IT vs break/fix for a small Connecticut business and When should a small business hire IT help vs DIY.