A ten-person electrical, plumbing, or HVAC contractor does not have an IT department, a security budget, or time to read long frameworks. It still has bank accounts, customer information, bids, email, and a phone full of work. Criminals do not skip small companies. They often prefer them because defenses tend to be thin.
The good news is that a few inexpensive steps remove most of the easy openings. This list is ordered by return on effort. Do the first ones before worrying about the later ones.
1. Protect email and accounts with multifactor authentication
Email is the key to nearly everything: password resets, invoices, bids, and banking notifications. Turn on multifactor authentication for every email account, starting with the owner and whoever handles money. Do the same for your accounting software, payroll, bank portals, and cloud storage. Use an authenticator app rather than text messages when you can.
2. Use a password manager
Reusing passwords is how one leaked login becomes five. A password manager creates and stores unique passwords so no one has to remember them or keep them on sticky notes. Choose a business plan that lets you share credentials safely and remove people when they leave.
3. Verify every payment change
The most expensive small-business cyber loss is often not ransomware but a fake request to change where money goes. Adopt a firm rule: any change to bank details, any new vendor, and any urgent payment request must be verified with a phone call to a number you already have. Write the rule down and tell everyone, including your bookkeeper.
4. Back up what you cannot afford to lose
Identify what would hurt most if it disappeared: accounting data, customer lists, bids, photos, and project files. Keep automatic backups of those in a service that keeps older versions, and keep at least one copy that ransomware cannot reach. Every few months, restore a file to prove it works.
5. Keep devices updated and locked
Turn on automatic updates for computers and phones. Use screen locks and encryption on laptops, tablets, and phones, since they get left in trucks. Make sure a lost device can be located or wiped. Retire computers that no longer receive security updates.
6. Protect against malware
Use reputable endpoint protection on business computers. Many operating systems include decent built-in protection, but a managed solution gives someone responsibility for noticing problems. Avoid installing software from unknown sources, and limit who can install programs.
7. Give people only the access they need
Not every employee needs access to accounting, customer data, or admin settings. Use separate accounts for each person, never shared logins, and make sure only one or two people have administrator rights. When someone leaves, disable their accounts the same day.
8. Teach the crew five simple habits
A short talk each quarter goes a long way. Cover these points.
- Do not click links or open attachments you did not expect, even from people you know.
- If a message asks for money, passwords, or gift cards, call to confirm.
- Report suspicious messages right away without fear of blame.
- Keep work devices for work.
- Tell the office immediately about a lost phone or odd behavior.
9. Secure the network
Change the default password on your office router, use a strong Wi-Fi passphrase, and keep a separate guest network. If you use cellular hotspots or trailer routers, change their default passwords too.
10. Have a basic plan for a bad day
Write down who to call if something goes wrong: your bank, your insurance agent, your IT contact, and a few key customers. Keep it printed. Know how to disconnect a computer from the network and where your backups are.
Think about insurance
Ask your agent whether your policy covers cyber events and fraud, and what conditions apply. Insurers increasingly ask about multifactor authentication and backups, so the steps above also help you qualify.
Do it over a few weeks
You do not need to do everything this month. Pick one step each week, in order. After ten weeks you will be far ahead of most businesses your size.
Where Ironfield Cyber fits
Ironfield Cyber offers practical, right-sized security for small contractors, including setup of these basics and ongoing support. If you want a short review of where you stand, we are happy to talk it through.