Practical cybersecurity compliance for businesses with 1–100 employees

What a small-business cybersecurity program actually contains

1. Written policies that name real tools and real people, approved by the owner and dated.
2. Identity controls — individual accounts, MFA on email and administrative access, a password manager, and access removal at departure.
3. Device standards — encryption, screen locks, automatic updates, endpoint protection.
4. Data protection — knowing what you hold, where it lives, and who can reach it.
5. Backups that are tested, stored separately from production.
6. An incident response plan with named contacts and a defined first hour.
7. Trained people, because most incidents start with a person, not a firewall.
8. Evidence, because the question is never only "do you do this?" but "can you show it?"

Where small businesses most often fall short

Across the controls ComplianceAnvil evaluates, the same items dominate: incomplete MFA coverage, backups that were never restore-tested, no written offboarding process, shared logins, and policies that were downloaded once and never approved or reviewed. These are the highest-value fixes and most cost nothing but attention.

About frameworks

Frameworks such as the NIST Cybersecurity Framework and CIS Critical Security Controls are useful references, and both publishers offer small-business guidance directly. ComplianceAnvil organizes similar practical ground in a workflow sized for a small business. We do not certify you against any framework, and no self-assessment tool can.

Sources worth reading directly: the NIST Small Business Cybersecurity Corner (nist.gov), CISA's Cyber Essentials (cisa.gov), and the FTC's small business cybersecurity guidance (ftc.gov). Reviewed February 2026.