The Security Basics Every 25-Person Company Needs
The security essentials a 25-person company should have in place, what's standard versus optional, and how to roll them out without slowing your team down.
A 25-person company needs a short list done well: multi-factor sign-in (MFA) on every account, company devices that are encrypted and kept updated, endpoint protection that real people watch, email filtering, backups you have actually restored from, same-day offboarding, regular staff training and a simple incident plan. Most businesses have some of these. The gaps are usually in the follow-through, not the tools.
Are we doing enough on security?
It's the question we hear most from owners and operations leads, and it's a fair one. You have antivirus, maybe MFA on email, and someone set up a backup a few years ago. It feels like enough until you try to explain it to a client, an insurer or yourself at 11 PM.
"Enough" isn't about having the most tools. It's about covering the ways small businesses actually get hurt: stolen passwords, a lost laptop, a convincing fake invoice, a former employee who still has access, or a file deleted with no clean copy to bring back. The basics below cover those.
We use the CIS Controls v8 Implementation Group 1 as our security baseline. It's a published set of practical safeguards written for organizations without a dedicated security team, and it's a useful yardstick for any company this size.
What are the security essentials for a small business?
1. Multi-factor sign-in on everything that matters
MFA means a password alone isn't enough to get in. The person also confirms on their phone or a security key. Start with email, Microsoft 365 or Google Workspace, remote access, banking and payroll, then work outward to every business app that supports it.
2. Company devices that are managed, encrypted and updated
A managed device is one your IT team can see and configure centrally. That lets you turn on disk encryption (so a lost laptop is a hardware loss, not a data loss), push operating system and app updates on a schedule, and wipe the device remotely if it goes missing.
3. Endpoint protection that people actually monitor
Modern endpoint protection watches for suspicious behavior on each computer, not just known viruses. The tool matters less than who reads the alerts. Software that flags a problem at 2 AM and waits for someone to notice on Monday is only half the job.
4. Email filtering
Most attacks on small businesses start in the inbox. A good filter catches phishing, malicious attachments and impersonation attempts before staff see them. It's also worth making sure your own domain is set up so others can't easily send mail pretending to be you. We cover that in why your emails land in spam or get spoofed.
5. Backups that have been tested
A backup you've never restored from is a hope, not a plan. Know what's backed up (including Microsoft 365 or Google Workspace data, which people often assume is covered), where the copies live, who can delete them and when someone last did a test restore. Our article Is your backup real? walks through the three questions to ask.
6. Offboarding the same day someone leaves
Former employees with working accounts are one of the most common and least dramatic risks. When someone leaves, their access should end that day, across email, shared drives, apps and devices.
7. Short, regular training
Your team is the last filter. Brief, regular training and occasional practice phishing emails help people recognize a fake invoice or an odd request from "the CEO." Keep it short and blame-free so people report mistakes quickly instead of hiding them.
8. A one-page incident plan
When something goes wrong, the first hour matters. A simple plan answers: who do we call, who can approve shutting something off, how do we reach the bank and the insurance carrier, and who talks to clients. If you want a head start, read what to do in the first 24 hours after a phishing click.
What's standard and what's optional?
Buyers often ask which tools are must-haves and which are nice to have. Here's how we think about it for a business with 20 to 100 people. Your industry, your clients' expectations and your insurance carrier can move items from one column to the other.
| Area | Standard for most small businesses | Often added as you grow |
|---|---|---|
| Identity | MFA on email and key apps, with suspicious sign-ins watched and acted on | Single sign-on |
| Devices | Managed, encrypted, updated, with endpoint protection watched by security analysts | Stricter controls on admin rights and which software can run |
| Spam and phishing filtering | Advanced impersonation protection, domain authentication monitoring | |
| Data | Tested backups, including cloud email and files | Longer retention, separate offsite copies |
| Web | Basic browser protections | Web filtering by category |
| People | Training, same-day offboarding | Formal policies, regular phishing simulations |
| Response | One-page incident plan | Tabletop exercises, documented recovery steps |
For Simple IT clients, managed detection and response (MDR) is part of the standard service, not an add-on. Security analysts watch for threats around the clock, and coverage includes every active account in Microsoft 365 or Google Workspace.
If a client contract, a security questionnaire or a framework like SOC 2 or HIPAA is in the picture, what you need is a question for your attorney or auditor. We help with the technical side once you know the target.
Will security tools get in the way of my team?
They can, if they're switched on all at once with no warning. That's when you hear "the new filter ate my client's email" or "I can't open the file I need." Most friction comes from rollout, not the tools themselves.
Here's how we keep it calm:
- Tell people first. A short note explaining what's changing, why and what they'll notice goes a long way.
- Start with a pilot group. Roll changes out to a few people, including someone who will tell you honestly when something is annoying.
- Run in watch mode before blocking. Many tools can report what they would have blocked before they start blocking it. That surfaces false alarms early.
- Tune, then expand. Adjust settings based on what the pilot found, then roll out to everyone.
- Make it easy to ask for help. If a tool blocks something legitimate, people should know exactly who to contact and get a quick answer.
Every security change in this article, from MFA policies to email filtering rules, should be validated and tested with a small group before it reaches the whole company. Settings that work well in one environment can block legitimate work in another.
What does a sensible order look like?
You don't have to fix everything this month. If you're starting from scratch, this order covers the most common risks first:
- MFA on email and financial systems.
- Confirm backups exist and run a test restore.
- Remove access for anyone who no longer works with you.
- Get every company device managed, encrypted and updating.
- Put endpoint protection with human monitoring on every device.
- Tighten email filtering and your domain's email settings.
- Start short, regular training.
- Write the one-page incident plan and share it with leadership.
None of this calls for you to become technical. It calls for someone to own it, check it regularly and tell you plainly where things stand. That's the job of our cybersecurity service.
Where to start
If you're not sure which of these you already have, the free IT Snapshot takes about five minutes and shows where the gaps are likely to be. If you'd rather talk it through, book a 15-minute call and we'll tell you what we'd look at first.
Last reviewed October 20, 2026. This article is general information, not legal, insurance or compliance advice, and reading it doesn't make you a Simple IT client. Have your IT provider confirm any steps for your setup, and talk with your attorney, insurance broker or auditor about how anything here applies to your business. See our Terms of Use.