Why cybersecurity matters to a small business

Learning edition: 5 October 2026. Introductory learning material.

A security incident can interrupt sales, payroll, customer service and access to business records. Its impact depends on the systems involved, the data exposed and the time needed to recover. There is no single attack-cost figure that applies to every small business.

Start here

This course is for small-business owners, managers and team members who coordinate everyday work with technical providers. No security qualification is required. You will need a notebook or an approved internal document for your exercises.

By the end, you should be able to:

• Map a critical business process to its systems, information and responsible people.
• Choose safe responses to suspicious requests and unexpected sign-in prompts.
• Prepare questions about account protection, devices and tested recovery.
• Recognize AI impersonation and set boundaries for AI data sharing and connected tools.
• Build a prioritized 30-day action plan with owners and completion evidence.

How to learn: Work through the 39 short lessons in order. Complete the four knowledge checks covering phishing, authentication, recovery and safer AI use, then the final review and action-plan exercise. Budget about 3 hours for reading and selected exercises, including 30–45 minutes for your plan. This is a planning estimate; implementing changes and working with providers takes additional time.

Keep your working notes in an approved internal location. Use invented examples in course discussions. Do not post passwords, recovery codes, customer records or details of exploitable weaknesses. A platform completion badge records learning activity; it is not a professional or compliance certification.

Start with business priorities

• Identify the services your team needs to keep operating.
• Record who owns each service and which suppliers it depends on.
• Discuss the consequences of unavailable, altered or disclosed information.
• Assign responsibility for practical improvements and for responding to incidents.

Activity: Choose one critical process. Record its owner, supporting systems and the first person to contact if it stops working.

Reference: NIST small-business cybersecurity framework resources. Check the source and your system provider’s current instructions before implementation.