Security & Compliance Basics for Small Teams
June 3, 2026
Small teams tend to treat security as something that starts when you hire someone to own it. In practice, the controls that prevent the most damage are cheap, boring, and available to a five-person company today.
This is the short version of what to do before you have a security function — ordered by how much risk each step removes per hour of effort.
The five that matter most
1. Multi-factor authentication, everywhere, no exceptions. Email first, then anything that touches money, then everything else. Prefer an authenticator app or a hardware key over SMS. This single control removes the large majority of account-takeover risk.
2. A password manager with shared vaults. The alternative is credentials in a spreadsheet or a chat thread, which is how a departing employee keeps access for two years. Team vaults also make offboarding a five-minute task.
3. A written offboarding checklist. When someone leaves: disable the account first, then transfer file ownership, then reset shared credentials, then remove them from the shared mailboxes and the signature roster. Most small-company breaches involve access that should have been removed months earlier.
4. Automatic updates on every device. Turn them on and stop debating it. Unpatched laptops are the most common entry point that does not require anyone to make a mistake.
5. A backup you have restored from. Once. Actually restore a file. A backup that has never been tested is a hypothesis.
Email-specific controls
Email is where small companies get hit, usually through invoice fraud rather than anything technically sophisticated.
- SPF, DKIM, and DMARC. Publish all three. Start DMARC in monitoring mode, read the reports for a month, then move to enforcement. This stops others from spoofing your domain.
- External-sender warnings. A banner on mail from outside the company costs nothing and interrupts impersonation attempts at exactly the right moment.
- A payment-change rule. Any request to change bank details is verified by phone, on a number you already had, no exceptions, regardless of who appears to be asking. Write it down and tell every new joiner.
- Consistent, centrally managed signatures. When everyone’s outbound mail looks the same, an impersonation attempt has fewer places to hide — and staff have something concrete to compare against.
Compliance, proportionately
Compliance obligations depend entirely on where you operate and who your customers are, and this is one area where generic advice is genuinely risky. What is broadly true for small teams:
- Know what personal data you hold and where. A one-page inventory — what data, which system, who can see it, how long you keep it — answers most of the questions a customer’s procurement team will ask.
- Have a privacy notice that matches reality. Including any tracking you run in email or signatures.
- Keep vendor records. A list of the services that process your customers’ data, with links to their terms. You will need it the first time a larger client reviews you.
- Get local advice before you commit to a framework. Whether you need a specific certification, and which one, is a question for someone who knows your jurisdiction and sector.
What you can safely defer
Small teams often over-invest in visible security theatre while leaving the basics open. Until the list above is complete, you can reasonably defer: a formal security-awareness training platform, penetration testing, a SIEM, and any certification you are not being asked for by a customer.
The one-page policy
Write a single page covering: MFA is mandatory; passwords live in the manager; devices auto-update; payment changes are verified by phone; and here is who to tell if something looks wrong. Have everyone read it on their first day.
A page that people have read beats a forty-page policy nobody opened. At small scale, that is the entire art of it.