The Federal Trade Commission does not run a small-business cybersecurity certification, but for any company handling consumer data it does something with similar effect: it enforces Section 5 of the FTC Act against unfair or deceptive data practices, and its case history defines what "reasonable" security means at each size of business. The FTC's own small-business guidance — its free cybersecurity publications for small business — is effectively that case history translated into a checklist. Orer News publishes information, not legal advice.
The framing that matters: security failures are prosecuted not as breaches but as broken promises — representations about protection that practices did not match.
What does the FTC's guidance actually cover?
Its small-business materials converge on a dozen practices: multi-factor authentication on email and financial accounts; unique strong passwords stored in a manager rather than a browser or spreadsheet; timely patching of operating systems, software, and firmware; disk encryption on laptops and phones; file backups kept offline or off-site; network firewalls; access control — employees get only what their role needs; and vendor management, since your data in a vendor's system is still your enforcement exposure. None of it requires an IT department; most of it is configuration, not procurement.
Why does enforcement reach small companies?
Because the deception theory is broad. A privacy policy promising safeguards is a representation; a breach enabled by absent multi-factor authentication, unpatched software, or shared logins makes it a misrepresentation — and the FTC has taken action against companies of modest size whose claims outran their practices. The order that typically follows requires decades of assessed audits, which is a heavier ongoing burden than the original fix. The economical read: the cheapest security program is one aligned to what you already claim, written down, and actually practiced.
What about phishing and payments?
The FTC's guidance treats phishing as the primary vector for small firms, and the defense is procedural: verify payment-change requests and wire instructions through a known channel before acting, train staff to treat urgency as a red flag, and script the out-of-band confirmation so employees have a rule to follow rather than judgment under pressure. Business email compromise — an impersonated executive or supplier redirecting a payment — is the loss event most likely to end a small firm, and it is defeated by a callback protocol that costs nothing.
What should a plan look like at small scale?
One page, three sections. Prevention: the checklist above, assigned to a named person with dates. Detection: who notices, and how — including monitoring of financial accounts for anomalies. Response: which systems get isolated, who calls which attorney or insurer, which customers must be notified and on what legal clock — state breach-notification laws set deadlines that begin at discovery, not at convenience. Then test the response piece annually with a one-hour tabletop: the first run of a plan should never be during the incident.
- Multi-factor authentication on email and money accounts — first, always
- Patch, encrypt, back up; restrict access by role
- Callback verification for every payment-detail change
- One-page response plan with legal notification deadlines
The FTC checklist is free, current, and written for businesses without security staff. Following it is the cheapest available alignment between what your privacy policy says and what your router settings do.
For more context, read When Can You Legally Say 'Made in USA'?.
For more context, read business insurance types.
For more context, read sba size standards.