Your first week with no IT department: where to start at no cost

Where do I start if I have no IT staff?

Start with a short written list of what you need to protect. The U.S. Small Business Administration recommends a cybersecurity risk assessment to identify where your business is vulnerable and to help create a plan of action (SBA: Strengthen your cybersecurity).

What does a first week look like?

• Day 1: write the list. Laptops, phones, email, customer records, the contracts you hold. A page is enough.
• Day 2: connect with CISA. CISA's list of no-cost services names three starting points for every organization. The first is to connect with your Regional Cybersecurity Advisor (CISA: No-Cost Cybersecurity Services and Tools).
• Day 3: ask about Cyber Hygiene scanning. The second starting point is CISA's Cyber Hygiene services, which help secure internet-facing systems from weak configurations and known vulnerabilities (CISA Cyber Hygiene Services). Check whether you are eligible and enroll if you are.
• Day 4: pick a few actions. The third starting point is CISA's Cybersecurity Performance Goals. CISA says small and medium-sized organizations can use them to prioritize a limited number of essential actions with high-impact security outcomes.
• Day 5: write a plan. The FCC's Small Biz Cyber Planner 2.0 helps you build a custom strategy and cybersecurity plan (SBA).

What should I do after the first week?

You now know what you protect, what no-cost help exists and what you still need. If the gap is expertise, compare two providers on the same questions. If the gap is budget, see whether an in-kind grant covers it.

Is this enough?

It is a start, not a finish. It gets a business with no IT staff from nothing written down to a plan and a short list of next steps, without spending anything.