Which cybersecurity tools does a small business need first?
Start with the work you need done: secure business accounts, keep devices managed and updated, recover important data, and assign someone to respond to alerts. Then buy tools for the gaps. A longer software list is not a substitute for an owner.
Start with four jobs, not four subscriptions
Our suggested starting worksheet is deliberately small. For each job, name the person or service responsible and one way to check that it works. NIST’s small-business resource index provides further reading on MFA, phishing, incident response and protecting data and devices.
On a small screen, scroll the table sideways to see every column.
| Job | First buying question | Evidence to ask for |
|---|---|---|
| Account access | Can we enforce stronger sign-in and remove access when people leave? | A documented onboarding/offboarding process |
| Device care | Which laptops are enrolled, updated and reporting? | An inventory reconciled against the management console |
| Recovery | Can we restore the files and systems that matter? | A recorded restore exercise |
| Response | Who investigates an alert after hours? | A named contact and agreed action authority |
Source: NIST: Small-business cybersecurity guidance by topic
Inventory what you already pay for
Before requesting quotes, collect the actual subscription names from your invoices and administration portals. Similar product names can hide different entitlements. Ask your IT provider to distinguish licenses, deployment and ongoing operations in writing.
For example, Microsoft documents Defender for Business as available standalone or within Microsoft 365 Business Premium. That makes checking existing entitlements a sensible first step; it does not show that your devices are enrolled or that someone is handling alerts.
Example: a 12-person design studio
Imagine a studio with laptops, a shared cloud drive and an outside IT contractor. This is a fictional planning example. Its first purchase decision should follow three checks: who can administer accounts, which laptops are managed, and whether a deleted client folder can actually be restored.
If those checks reveal an unowned task, write that task into the service request. “Investigate endpoint alerts outside office hours and contact our duty owner” is a more useful request than “add advanced security.” Existing tools might cover part of the job; the quote should show the remaining work.
What should wait?
Defer a new dashboard if nobody can explain who will act on it. Ask for a small rollout with success criteria: devices visible, policies applied, alerts reaching the right person and a documented handoff. This is a proposed acceptance process, not evidence that we have tested a particular product.
- Record critical accounts, devices and data locations.
- Choose one accountable owner for each job.
- Check current entitlements before buying replacements.
- Compare management and response work alongside license fees.