Starting a business with a $100 budget means every decision matters, including how you protect your accounts, customer information, devices, and work. Cybersecurity can sound like something that requires expensive software and a dedicated IT department. But many important first steps are habits and settings you can begin with the tools you already have.
No checklist can guarantee that a business will avoid a cyber incident. Security is an ongoing process, not a one-time purchase. The goal is to reduce avoidable risks, make it harder for someone to misuse an account or device, and prepare to respond if something goes wrong. The National Institute of Standards and Technology (NIST) describes cybersecurity as continuous improvement, a useful mindset for a business at any stage.
1. Protect your most important accounts first
Your business email account is a priority because it may be used to reset passwords for other services. Start there, then secure accounts that control your money, website, customer records, file storage, and any remote access to business systems.
Turn on multi-factor authentication (MFA) wherever it is available. MFA asks for another proof of identity in addition to a password. If you have a choice, use a phishing-resistant method such as a security key or a built-in device authenticator. An authenticator app is another option. Any MFA is generally a meaningful improvement over a password alone, but methods differ in strength.
Review account recovery options, too. Remove old phone numbers and email addresses you no longer control. Store backup codes somewhere secure, not in an unprotected document next to the account password.
2. Use unique passwords, not memorable repetitions
Reusing one password across multiple accounts creates a chain of risk: if one service is compromised, other accounts using the same password may be exposed too. Use a long, unique password for every account. CISA recommends passwords that are at least 16 characters long, or a passphrase made from several unrelated words.
A password manager can help you create and store distinct passwords without having to memorize each one. Choose a reputable option that fits your needs, protect its main account with a strong, unique password and MFA, and make sure you understand how to recover access. If a manager is not part of your budget today, prioritize unique passwords for your most sensitive accounts and avoid saving them in a plain-text file.
Change default passwords on devices and services before using them. Check routers, cameras, shared accounts, and any business equipment that came with preset login details. Where possible, give each person an individual account instead of sharing one login.
3. Keep software and devices current
Updates often include fixes for security weaknesses. Turn on automatic updates for operating systems, browsers, phones, and business applications when practical. Make a simple list of devices and services you rely on, then check that none are forgotten, including the router and any device used to access business accounts.
If a device or application no longer receives security updates, plan to replace it or stop using it for sensitive work. That may not be possible immediately on a starter budget, so document the issue and avoid using unsupported devices for tasks that involve important customer or financial information.
Be cautious with unfamiliar software. Before installing an app or browser extension, consider whether you need it, who provides it, and what access it requests. A tool asking for more access than its job requires deserves a closer look.
4. Make backups, and test whether they work
A backup can help you recover files if a device fails, a mistake deletes information, or ransomware makes data inaccessible. Decide which information is essential: customer and order records, bookkeeping files, business documents, website content, and important configurations may all matter.
Use a backup method appropriate to the information and your budget. Protect backup accounts with MFA, limit who can change or delete backups, and keep at least one copy separate from the device or account it protects where feasible. A backup that is always connected with the same permissions as your everyday files may be vulnerable to the same problem.
Do not assume a backup is usable just because it ran. Try restoring a small, noncritical file. Confirm that you can find the right version and open it. Repeat the test periodically, especially after changing your backup process. NIST’s small-business guidance also recommends protecting and testing backups.
5. Build a simple phishing routine
Phishing messages try to persuade people to click a link, open an attachment, share credentials, or send money. They may look like routine business communications, and they can arrive by email, text, or other channels.
Create one easy rule: when a message asks for a password, payment, sensitive information, or urgent action, pause and verify it through a separate, trusted channel. For a payment change, call a known number already on file, not a number in the unexpected message. Avoid replying to suspicious messages or opening attachments you were not expecting.
If you work alone, this can still be a routine. Take a moment to inspect the sender and the request, then navigate to a service through your saved bookmark or by entering its address yourself rather than following an unexpected login link. If you have a team, agree on how to report suspicious messages and what to do if someone clicks one. CISA’s business cybersecurity essentials include employee awareness and phishing guidance.
6. Limit access to what each person needs
Use separate accounts for each worker, and grant only the access necessary for their responsibilities. Avoid using an administrator account for routine browsing, email, or document work. Keep administrator access limited, protect it with MFA, and review who has access when someone leaves or changes roles.
This principle applies to software and AI tools, too. Before connecting a tool to business systems, decide what work it should perform, what information it needs, what permissions it should have, and where a person must review or take over. If you are exploring ACORP’s AI employees, treat access boundaries and human oversight as part of the setup, not as details to figure out later. No tool removes the business owner’s responsibility to manage information and access carefully.
7. Write down what you would do if something goes wrong
A short response note is better than relying on memory under pressure. Record who controls important accounts, how to contact your bank and service providers, where backups are stored, and who needs to be informed if business information may be exposed.
If you suspect an account has been taken over, use a trusted device to change its password, revoke unfamiliar sessions if the service allows it, and review recovery details and recent activity. Contact the relevant provider through its official support channel. If financial or sensitive personal information may be involved, seek qualified help to understand appropriate next steps. Keep notes about what happened and when.
For a business using outside services or handling sensitive data, check the provider’s privacy and security information and understand what data you are sharing. ACORP’s Privacy Policy is one example of where to review how a service describes its information practices.
Make cybersecurity a small-business habit
You do not have to solve everything on Day 1. Start with the accounts and information that would be hardest to lose or recover. Then revisit your settings as your business adds people, devices, customers, and services. For more small-business guidance, NIST’s Cybersecurity Basics and CISA’s no-cost cybersecurity resources are useful places to continue learning.
Today’s Action
Choose your business email account. Turn on the strongest available MFA, review its recovery email and phone number, and replace any reused password with a long, unique one. If you already have those protections, test restoring one noncritical file from a backup instead.
This lesson is general educational information, not legal, tax, financial, or professional advice, and it is not a substitute for advice from a qualified professional. ACORP makes no promises or guarantees about income, profit, or any business result; results depend on your own decisions, effort, and circumstances. Examples are illustrative, not typical outcomes. You are responsible for your own business decisions. Learn more in our Course Terms of Use.