Cybersecurity Awareness Month for small business has always had a mismatch. The campaign’s advice assumes someone on staff owns security. At a 30-person tax firm, insurance agency, or mortgage shop, nobody does.
Last Updated: September 2026
Key takeaways
- Train staff in week one with a live, 30-minute session on the attacks your industry actually sees, and record who attended.
- Review every vendor that holds client data in week two, including its breach notice terms and whether MFA is enforced.
- Scan for vulnerabilities in week three, give each fix an owner and a date, and test one backup restore.
- Rehearse the first hour of an incident in week four with a 45-minute tabletop and a one-page contact sheet.
- Finally, keep the records. By November 1, that evidence is what clients, carriers, and examiners ask to see.
However, that does not make the month useless. It changes what the month is for. If your firm handles client Social Security numbers, policy data, or loan files, October is a built-in deadline. It is the month to do the security work you already owe clients, carriers, and regulators, and to write down that you did it.
This year the campaign runs two official themes. The Cybersecurity and Infrastructure Security Agency is running “Securing the Next 250,” aimed mostly at critical infrastructure operators. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them,” which focuses on everyday habits. In fact, neither was written for a firm with one office manager and an outsourced IT provider.
So this guide turns Cybersecurity Awareness Month for small business into four weeks of work. Each week covers one part of a security operating rhythm: train, review vendors, find and fix gaps, and prepare for an incident.
Why Cybersecurity Awareness Month for Small Business Should End With Evidence
Most professional firms do not need convincing that client data is valuable. They need a way to assign security work and prove it happened. The pressure usually comes from outside. A carrier sends a cyber insurance application. A client sends a vendor security questionnaire. A lender, auditor, or examiner asks for documentation. Each one asks some version of the same question: show me.
The threat data explains why those questions keep getting harder. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48 percent of breaches, a 60 percent jump in one year. Exploiting unpatched vulnerabilities also overtook stolen credentials as the top way attackers get in, at 31 percent of breaches versus 13 percent. The FBI’s 2025 Internet Crime Report logged $20.877 billion in reported losses, up 26 percent. Business email compromise alone accounted for about $3.05 billion.
The Small Business Obligations Cybersecurity Awareness Month Should Surface
The threat describes the risk. Your obligations, however, describe the response. Depending on what your firm does, they may include:
- The FTC Safeguards Rule, which applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers and many tax preparers. See the FTC’s guidance.
- The IRS expectation of a written information security plan for tax professionals, with a template in IRS Publication 5708.
- State insurance data security laws, many based on the NAIC model law. Requirements vary by state.
- State breach notification laws, which follow the residence of the people affected, not the location of your office.
Which of these apply depends on your activities, your regulator, your state, and your contracts. Therefore, confirm yours with counsel rather than assuming. Before week one, answer five questions in writing:
- What sensitive information do we handle?
- Who can access it, including vendors?
- Which rules, contracts, or carrier requirements apply to us?
- What evidence would we need to show if someone asked?
- Who owns this work, by name?
Week 1: Train Staff on the Attacks Your Firm Actually Sees
Generic phishing training fails because the examples do not look like your inbox. Run one live, 30-minute session with examples from your own line of work.
- Tax and accounting firms: On September 16, the IRS and Security Summit warned tax professionals about fraudsters posing as new clients. These messages carry malicious links or attachments disguised as tax documents. The same release flagged phishing aimed at EFIN, PTIN, and CAF numbers. Train on both before the October 15 extension deadline fills everyone’s inbox.
- Independent insurance agencies: Show what a compromised producer mailbox looks like from the client side. Fake invoices and payment change requests go out under a trusted name.
- Mortgage brokers and lenders: Walk through a spoofed closing email with altered wire instructions. Make one rule non-negotiable: verify every wire change by phone, using a number you already had.
In addition, add one voice example. Attackers now call staff and executives while posing as internal IT, as we covered in our help desk impersonation guide.
Then record who attended and when. A dated attendance record beats a forwarded link. It is also one of the first things a security questionnaire asks for.
Week 2: Review the Vendors Who Hold Your Clients’ Data
Your client data does not live only on your computers. It lives in tax software, agency management systems, loan origination platforms, cloud storage, payroll, and your IT provider’s tools. That is why third-party involvement now shows up in nearly half of breaches.
First, build a simple vendor list this week. For each vendor, note four things:
- What client or employee data the vendor holds
- Who at your firm owns the relationship
- How quickly the vendor must notify you of an incident, per the contract
- Whether multifactor authentication is enforced on your firm’s accounts
In fact, the last item matters more than it looks. Verizon found that only 23 percent of third-party organizations fully fixed their MFA gaps. In other words, a strong password on your side does little if the vendor account behind it is exposed.
If your firm is covered by the Safeguards Rule, vendor oversight is part of the rule itself. For example, covered firms must select capable service providers, require safeguards by contract, and assess them periodically. Our third-party data breach guide covers what to do when a vendor gets hit. Our vendor payment fraud post shows how one redirected email cost a small town $189,199.
Week 3: Find and Fix the Gaps Attackers Use First
Attackers now get in through unpatched systems more often than through stolen passwords. The usual suspects are a firewall, VPN, or remote access tool nobody has updated. Similarly, an old workstation still running an unsupported operating system is another.
Credentials still matter, though. Verizon’s data shows half of ransomware victims had a credential or infostealer event within 95 days before the attack. In short, stolen logins are often the setup, not the finish.
This week’s work:
- Run a vulnerability scan on internet-facing systems and staff devices.
- Give every finding an owner and a fix-by date. A scan nobody acts on is just a list of liabilities.
- Turn on MFA for email, remote access, and your core client software.
- Test one backup restore. A backup you have never restored is a hope, not a control.
Tax firms can map this week to the IRS “Security Six”: antivirus, firewalls, backups, encrypted drives, MFA, and virtual private networks. Our ransomware guide for small business covers how an attack unfolds once someone gets in.
Week 4: Rehearse the First Hour of an Incident
The first hour of an incident decides the rest of the week. However, in most small firms, that hour goes to guessing. Who decides whether to shut down email? Who calls the IT provider and the carrier? And when does the notification clock start?
Those clocks are real, and some are short. Examples, depending on who you are:
- FTC Safeguards Rule: Covered firms must notify the FTC within 30 days of discovering an event involving unencrypted information of at least 500 consumers.
- State insurance data security laws: In states that follow the NAIC model, licensees generally must notify the insurance commissioner within 72 hours of determining a cybersecurity event occurred. Check your state’s version.
- Tax professionals: The IRS directs firms to contact their local IRS Stakeholder Liaison and report the breach to the state tax agency.
- State breach notification laws: Deadlines vary. California, for example, now requires individual notice within 30 days of discovery.
Run a 45-minute tabletop exercise with your leadership and your IT provider. Pick one realistic scenario, such as a compromised mailbox sending wire instructions to clients. Then walk through the first hour, minute by minute.
Finally, the output is a one-page contact sheet. It names the decision owner, the IT provider, the cyber insurance claims line, outside counsel, and your bank’s fraud line. Insurance agencies can build from our 72-hour incident response plan. Every firm can use the post-breach playbook for the steps after that first hour.
What Cybersecurity Awareness Month for Small Business Should Leave Behind
The point of Cybersecurity Awareness Month for small business is a file, not a feeling. By November 1, your firm should be able to pull up five things:
- A dated training record showing who attended
- A vendor list with data held, contract notice terms, and MFA status
- Scan results with an owner and a date for each fix
- A one-page incident contact sheet and a note on the tabletop exercise
- One named person who owns the security program
That is the evidence clients, carriers, and examiners ask to see. It also becomes next October’s starting point, so the month gets easier every year instead of starting from zero.
Cybersecurity Awareness Month for Small Business: FAQ
What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month is a national campaign held every October. The Cybersecurity and Infrastructure Security Agency and the National Cybersecurity Alliance lead it jointly. It promotes practical security habits for individuals and organizations.
What is the 2026 Cybersecurity Awareness Month theme?
There are two. CISA’s theme is “Securing the Next 250,” focused on long-term resilience for critical infrastructure. The National Cybersecurity Alliance’s theme is “Don’t Make It Easy for Them,” focused on everyday security habits.
What should a small business do for Cybersecurity Awareness Month?
Treat the month as a four-week work plan rather than an awareness campaign. Train staff on real attacks in week one, review vendors in week two, scan and fix gaps in week three, and rehearse an incident in week four. Then keep the records, because clients, carriers, and examiners ask for evidence.
Does the FTC Safeguards Rule apply to my firm?
It applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers, many tax preparers, and other firms engaged in financial activities. However, coverage depends on what your firm actually does. Review the FTC’s guidance and confirm with counsel.
Do tax preparers need a written information security plan?
The IRS expects professional tax preparers to maintain a written information security plan. In addition, it publishes a template in Publication 5708. Each firm must tailor its plan to its own size, systems, and risks.
How much time does the Cybersecurity Awareness Month plan take a small business?
Plan on a few hours per week for the person who owns the work, plus about 30 minutes of staff time for training. The tabletop exercise needs 45 minutes from leadership and your IT provider.
If we only do one week, which should it be?
Week four. Naming a decision owner and building an incident contact sheet costs little. It also removes the most expensive delay in a real incident: the first hour spent figuring out who is in charge.
Make Cybersecurity Awareness Month for Small Business a Routine
If Cybersecurity Awareness Month for small business surfaces more open items than one person can track, that is the gap defend-id Business Essentials is built for. It gives a firm without a security leader one place to run staff training, review vendors, scan for vulnerabilities, and reach 24/7 incident response support, and it keeps a record of what was done. The platform does not replace your program or make any rule go away. Instead, it makes the work easier to assign, finish, and show. See how it works at defend-id.com.
