1. Give each person their own login instead of sharing one account.
2. Turn on two-step sign-in for email, banking, the domain, and payment accounts. Save the backup codes somewhere safe and set up a second way in, such as a second admin or a backup sign-in method, so a lost phone or a staff departure does not lock the business out.
3. Let devices and apps install updates on a regular schedule.
4. Set up a backup, then restore one file without replacing the current version, keeping both copies if asked, to prove it works.
5. Agree on how staff report a strange email, text, or payment request.

In Microsoft 365

1. In the Microsoft Entra admin center, under Entra ID > Overview > Properties, check that security defaults are on, or that your own sign-in rules cover every user. Security defaults make everyone register for two-step sign-in, and admins must use it every time. Before you turn them on, tell staff they will need to set up the Microsoft Authenticator app at their next sign-in. Check whether a copier, scanner, or older mail app sends email for you, because security defaults block the older sign-in methods these often use.

In Google Workspace

1. In the Admin console, under Security > Authentication > 2-Step Verification, allow users to turn it on. Have everyone set it up and check the enrollment report, then turn on enforcement. Enforcing before people have set it up can lock them out.

If an account may be compromised

1. Change the password from a trusted device and sign out of every other session.
2. Check for forwarding rules, inbox rules or filters that move or delete mail, connected apps, and any sign-in method, recovery phone, or recovery email you did not set up. Remove anything you do not recognize.
3. If there may be an active breach, such as files suddenly locked or renamed, disconnect the affected computers from the network by unplugging the cable or turning off Wi-Fi, but leave them on. Do not wipe, reset, or reinstall anything. Then contact a qualified incident-response professional, and your cyber insurer if you have one. Do not pay anyone who contacts you first.

• Someone clicked a suspicious link or typed a password into a strange page.
• An account sent messages that no one wrote.
• You are not sure who can sign in to the business email or domain.

We review the accounts that matter most, how people sign in, who holds admin rights, and how the business would get back in if a login were lost. We explain each step in plain language and agree on changes before making them.

What should we do if someone clicked a phishing link?

Change that account’s password from a trusted device, sign out other sessions, and check for new forwarding rules. Tell your bank or payment provider if money or card details may be involved. Then have Little Fight NYC or another trusted IT helper check what else was reached.

Do we need extra antivirus software?

Current Mac and Windows computers include built-in protection. Keeping them updated and using two-step sign-in matters more than adding another product. Some businesses need more, depending on the information they handle. Little Fight NYC sets up small business security basics: updates, two-step sign-in, and tested backups.