Small businesses are not too small to be targeted. Most attacks are automated: they try leaked passwords, send convincing fake invoices and look for computers that have not been updated. A handful of habits blocks most of it.
The trouble is that security advice is usually written for IT departments. This prompt turns it into a short, plain routine for your office, sized to the tools you actually use.
How to use it
- List your setup honestly: how many people, which email (Microsoft 365 or Google Workspace), devices, where files live, how you back up, who has admin access.
- Run the prompt. You get a one-page policy, a setup checklist and a monthly 15-minute routine.
- Do the setup checklist this week. Put the monthly routine in someone's calendar.
security-routine.txt
Create a simple cybersecurity routine for my small business. Write for non-technical staff. Business: [name], [industry], [number of staff], [office / remote / mixed] Email and files: [e.g. Microsoft 365 / Google Workspace, OneDrive, Dropbox] Devices: [e.g. 6 Windows laptops, 2 Macs, staff phones] Key systems: [e.g. accounting software, CRM, website, online banking] Current backups: [describe or "none"] Who has admin access: [roles] Sensitive data we hold: [e.g. client addresses, payment info, health info] Write: 1. A one-page security policy in plain language (what everyone must do and why), under 300 words. 2. A setup checklist for this week, ordered by impact: MFA, password manager, updates, backups, admin accounts, Wi-Fi, device locks. Each item: what to do, in my specific tools, and who does it. 3. A monthly 15-minute routine checklist. 4. "How to spot a scam": 6 signs of phishing and fake invoices, with what to do instead. 5. "If something goes wrong": the first 5 steps and who to call. Rules: concrete steps for the tools I listed, no jargon without a one-line explanation. Do not recommend specific paid products unless I ask. Canadian English.
The five that matter most
- Multi-factor authentication on email, banking, accounting and your website. It stops most account takeovers.
- A password manager for the team, so nobody reuses passwords.
- Automatic updates on every computer and phone.
- Backups you have tested, including one copy that is not connected to your network.
- A rule for payments: any change to bank details or an urgent payment request gets confirmed by phone, using a number you already have.
This is a starting point, not a full security assessment. If you handle health, payment or sensitive personal data, or you have had an incident, get a professional review.