Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Checklist
Small Business Security Checklist
The thirty-day baseline: the controls that stop the majority of small-business incidents, ordered by impact.
- Intended audience
- Owners and office managers without dedicated IT
- Difficulty
- Beginner
- Estimated time
- 30 minutes
- Access
- Free
NIST CSF
CIS Controls
All industries
Retail
Professional services
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Prioritize the thirty-day baseline controls that prevent the most damage for the least cost.
- Enable MFA and centralize credentials in a password manager as first steps.
- Set up automated backups and confirm recovery options before relying on cloud storage alone.
- Document actions taken so the work itself becomes usable evidence later.
Order matters
Work top to bottom. Identity and backups prevent the most damage for the least money, so they come before anything that requires a purchase.
Key takeaways
- Identity controls and backups come first because they prevent the most damage for the least money.
- Automatic updates and versioned cloud storage reduce risk without requiring a new purchase.
- Restricting who can approve payments or change bank details addresses a common fraud vector directly.
- Recording what was done and when turns a one-time cleanup into evidence you can reuse.
Checklist
Progress0 of 12 (0%)
Progress is saved in this browser only. It is not a compliance record.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
CISA
Cross-Sector Cybersecurity Performance Goals(opens in a new tab)Link last confirmed 2026-02-01
CISA
Secure Our World — Small Business Resources(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 1
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This resource is educational readiness material. ComplianceAnvil is not a certification authority, assessor, or law firm, and this content is not legal advice or a compliance assessment.
Related resources
Matched on shared frameworks, topics, and program packs.
Checklist
Cybersecurity Self-Assessment Checklist
A fast, honest look at your current security posture across identity, devices, data, people, and response.
Beginner
25 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Template
Acceptable Use Policy
What employees may and may not do with company systems, data, devices, and AI tools.
Beginner
25 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Backup Verification Log
Proof that backups exist, run, and have actually been restored at least once.
Beginner
15 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Exercise
Build Your First Asset Inventory
Practice building an inventory from a realistic ten-person business, then apply the same pattern to your own.
Beginner
20 min
Free
CIS Controls
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.