Cybersecurity Expectations for Small Businesses: What Clients, Insurers, and Vendors Now Expect
- CYBERRISKED®
- May 8
- 11 min read
Updated: May 9
For a long time, many small businesses treated cybersecurity as something that mostly mattered to big companies. That was understandable. After all, a small business may not have a full IT department. It may not have a cybersecurity team. It may not have a large budget for consultants, tools, audits, or formal risk assessments.
But the expectations around cybersecurity are changing. Today, small businesses are often asked more cybersecurity questions by clients, insurers, vendors, banks, payment processors, and other organizations they work with.
Sometimes the questions are as simple as:
Do you use multifactor authentication?
Do you train your employees on phishing?
Do you back up important business data?
Do you have a process for handling suspicious payment requests?
Do you limit who has access to sensitive information?
Other times, the questions are more formal and tied to a contract, insurance application, or vendor review:
A client may send a vendor security questionnaire
An insurance company may ask about your cybersecurity controls before offering coverage
A larger business may want to know how you protect customer information before signing a contract
This doesn’t mean every small business needs to become a cybersecurity expert. But it does mean cybersecurity is becoming a normal part of doing business.
Why expectations are changing for your small business
Your small business may be connected to other organizations in more ways than ever.
Specifically, you may be:
Using cloud software
Sending invoices by email
Storing customer records online
Accepting electronic payments
Working with vendors who have access to your systems or information
Handling employee, client, patient, student, member, or customer information
Even if your business is small, your connections matter. A criminal doesn’t always attack the largest company directly. Sometimes they target a smaller business because it may have weaker defenses, fewer internal checks, or more informal processes. A cyber incident at your business can also create risk for the people and organizations connected to you.
For example:
A fake invoice can trick an employee into paying the wrong account
A compromised email account can be used to scam clients or vendors
A stolen password can give someone access to business systems
A ransomware attack can interrupt operations
A lost laptop or exposed file can put customer information at risk
A poorly protected account can become a doorway into another organization
That’s why clients, insurers, vendors, and partners are paying closer attention. They’re not always expecting perfection. But they are increasingly expecting basic cyber hygiene.
What clients may expect from you
Clients want to know that your business can be trusted. That trust may involve your work quality, your reliability, your communication, your pricing, and your professionalism. But it may also involve how you handle information and payments.
A client may expect you to protect:
Customer records
Project files
Contracts
Payment information
Login credentials
Confidential business information
Shared documents
Email communications
If you provide services to another business, your client may also ask how you protect their information. This is especially true if you have access to their systems, their customers, their employees, their financial information, or their internal documents.
A client may not use the word “cybersecurity.” They may ask you in simpler ways:
Who has access to our files?
How do you protect our information?
Do you require strong passwords?
Do you use multifactor authentication?
What would you do if a business email account was compromised?
How do you make sure payment instructions are real?
How do you handle sensitive documents?
These are reasonable questions. For a small business, the goal is not to sound like a large corporation. The goal is to have clear, honest answers.
What insurers may expect from you
Cyber insurance has also changed the conversation. Years ago, some businesses could buy cyber coverage with very little discussion about their actual security practices. Today, many insurers are asking more detailed questions.
They may ask whether your business uses:
Multifactor authentication
Regular data backups
Antivirus, endpoint protection, or other security tools
Software updates
Employee cybersecurity training
Email security controls
Payment verification procedures
Incident response planning
Access controls
Vendor management practices
The exact questions vary by insurer, policy, business size, industry, and type of coverage. But the larger point is simple: cyber insurance is not just about buying a policy after something goes wrong. Insurers often want to understand what the business is doing to reduce the chance of a cyber incident in the first place.
That doesn’t mean every small business will be asked for the same level of detail. But if your business applies for cyber insurance, renews a policy, or increases coverage, you may be asked to describe your cybersecurity practices.
This is one reason it helps to document what you already do.
If you train employees, keep a record.
If you use multifactor authentication, know where it is turned on.
If you back up data, know what is backed up and how often.
If you have a payment verification process, write it down.
A simple written process is often better than a verbal habit that only one person understands.
What vendors and partners may expect from you
Cybersecurity expectations also flow in both directions. You may expect your vendors to protect your business information. Your vendors may expect the same from you.
For example, a payroll provider, bookkeeper, IT provider, marketing agency, payment processor, or software platform may need access to sensitive business information. That creates responsibility on both sides.
Your business should be asking basic questions of vendors:
What information do they need?
Who will have access to it?
How do they protect it?
Do they use multifactor authentication?
What happens if they have a security incident?
Can access be removed quickly if the relationship ends?
But vendors and partners may also ask questions of you. A larger client or partner may want to know whether your team can protect shared files. A payment partner may want to know how your business handles account changes. A software provider may expect you to manage your users responsibly.
This isn't just paperwork. Many cyber incidents happen because normal business relationships are abused. Criminals impersonate vendors. They send fake payment instructions. They compromise email accounts. They create lookalike domains. They try to insert themselves into ordinary business conversations. That's why vendor and payment processes matter.
The basics small businesses are expected to have
The good news is that many expectations come back to a small number of practical habits. You don't need to start with a giant cybersecurity program.
Just start with the basics.
Multifactor authentication
Multifactor authentication, often called MFA, adds another step when someone signs in. Instead of relying only on a password, the user also needs something else, such as a code, app prompt, security key, or other verification method.
For many small businesses, MFA should be turned on for:
Email
Banking
Payroll
Accounting software
Cloud storage
Remote access
Administrator accounts
Customer management systems
Any system containing sensitive information
If you only do one thing first, MFA is usually one of the strongest places to start.
Employee training
Cybersecurity isn't only a technology issue. People make decisions every day that affect the business. They open emails. They answer phone calls. They click links. They download files. They approve payments. They respond to vendor requests. They handle customer information.
That's why employee training matters. Training doesn't need to scare people. It should help them recognize common risks and know what to do.
At a minimum, employees should understand:
How phishing works
How fake invoices work
How business email compromise works
How to report suspicious messages
How to verify payment changes
Why passwords and MFA matter
What information should not be sent casually by email
Who to contact when something feels wrong
Training shouldn't be a one-time event that everyone forgets. It should be repeated and reinforced in plain language.
Strong passwords and password management
Weak passwords are still a common problem. Employees may reuse the same password across work and personal accounts. They may save passwords in browsers without understanding the risk. They may share passwords by email or text. They may use simple passwords because they're easier to remember.
Small businesses should move toward:
Unique passwords for each account
Longer passwords or passphrases
A trusted password manager
No shared passwords when individual accounts are available
MFA on important accounts
Quick removal of access when someone leaves
The goal isn't to make everyone memorize dozens of complex passwords. The goal is to make secure access easier to manage.
Software updates
Outdated software creates unnecessary risk. Software updates often fix security weaknesses. If updates are ignored for too long, criminals may have an easier path into a system.
Small businesses should always pay attention to updates for:
Computers
Phones
Tablets
Routers
Web browsers
Business software
Accounting systems
Security tools
Website platforms
Plugins and extensions
Whenever possible, automatic updates should be enabled. For systems that can't update automatically, someone should be responsible for checking regularly.
Backups
Backups matter because things go wrong. A computer can fail. A file can be deleted. A device can be stolen. A ransomware attack can lock business data. A cloud account can be compromised. These things happen more often than people think.
The question is not only “Do we back up?” The better questions are:
What data is backed up?
How often is it backed up?
Where are the backups stored?
Who can access them?
Have we tested whether we can restore from backup?
Would the backup still be available if a main account was compromised?
A backup that has never been tested may not help when the business needs it most.
Access control
Not every employee needs access to everything. Small businesses often grow through trust and flexibility. That can be a strength. But it can also create risk if too many people have access to sensitive systems. Access should be based on business need.
For example:
Only certain people should access payroll.
Only certain people should approve payments.
Only certain people should manage administrator accounts.
Former employees should have access removed promptly.
Shared accounts should be avoided where possible.
Sensitive folders should not be open to everyone by default.
This isn't about not trusting employees. It's about reducing the damage that can happen if an account is misused, compromised, or left active after someone leaves.
Payment verification
Payment fraud is one of the most practical risks for small businesses. A criminal may impersonate a vendor, client, executive, landlord, contractor, or employee. They may claim that payment instructions have changed. They may ask for a wire transfer, ACH change, gift card purchase, urgent invoice payment, or updated direct deposit.
The message may look normal because it appears inside an existing email conversation or comes from a lookalike address.
Small businesses should have a simple rule:
Don't change payment instructions based only on an email. Verify the change through a trusted method already on file. That may mean calling a known phone number, using a known vendor portal, or confirming with a known contact through a separate channel. This process should be written down and taught to anyone who handles payments.
What small businesses should be ready to answer
As expectations rise, your small business should be ready to answer basic cybersecurity questions without scrambling. You don’t need a perfect policy binder.
But you should be able to answer questions like these:
Do we use multifactor authentication on important accounts?
Do we train employees on phishing and scams?
Do we have a process for verifying payment changes?
Do we back up important data?
Do we know who has access to sensitive systems?
Do we remove access when employees or vendors leave?
Do we keep software and devices updated?
Do we have someone responsible for cybersecurity decisions?
Do we know what we would do if an account was compromised?
Do we have cyber insurance, or have we discussed whether we need it?
If the honest answer to some of these questions is “not yet,” that’s not a reason to panic. It’s a place to start.
Documentation doesn't have to be complicated
One mistake small businesses make is assuming documentation has to be formal, legalistic, or complicated. It doesn’t. A simple one-page process can be valuable.
For example:
Payment change process
We don’t accept payment changes by email alone.
We verify changes using a known phone number or trusted portal.
A second person reviews new vendors or changed payment instructions.
We save confirmation records.
Suspicious requests are reported to the owner, manager, or designated contact.
That’s not complicated. But it is much better than relying on memory.
The same idea can apply to:
Employee onboarding
Employee offboarding
Password management
Software updates
Backups
Incident reporting
Vendor access
Cybersecurity training
Small businesses don’t need paperwork for the sake of paperwork. They need simple instructions that help people make better decisions.
The role of leadership
Cybersecurity expectations can’t fall only on one employee. If leadership treats cybersecurity as optional, employees will too. The owner, manager, office lead, operations lead, or senior team needs to set the tone.
That doesn’t mean leadership must understand every technical detail. But leadership should be clear about expectations:
Suspicious emails should be reported.
Employees should not be embarrassed for asking questions.
Payment changes should be verified.
Security shortcuts should not be rewarded.
Training should be taken seriously.
Access should be reviewed when roles change.
Basic cyber hygiene should be part of normal operations.
A healthy cybersecurity culture doesn’t mean everyone is afraid. It means people know what to watch for, know when to pause, and know who to ask.
What this means for very small businesses
If your business has only a few people, this may still apply to you. A two-person or five-person business can still receive phishing emails. It can still lose access to an account. It can still be tricked by fake payment instructions. It can still have customer information exposed. It can still be asked cybersecurity questions by a client or insurer.
Smaller businesses may not need the same structure as larger organizations. But they still need basic habits.
For a very small business, a good starting point may be:
Turn on MFA for email, banking, payroll, and accounting.
Use a password manager.
Back up important files.
Write down how payment changes are verified.
Train everyone on common scams.
Review who has access to key accounts.
Keep devices and software updated.
Know who to call if something goes wrong.
What not to do
As expectations rise, small businesses may feel pressure to buy tools quickly. Tools can help. But tools aren’t the whole answer. Be careful about jumping straight to expensive products before understanding your most likely risks.
Also avoid these mistakes:
Assuming cybersecurity is only an IT issue
Assuming a small business is too small to be targeted
Buying cyber insurance without understanding what it requires
Letting too many people share the same account
Treating employee training as a one-time checklist item
Relying on email alone for payment changes
Keeping old employee accounts active
Having backups but never testing them
Waiting for a client questionnaire before getting organized
The better approach is to build from the basics.
A practical first step
If you’re not sure where to begin, start with a simple review.
Ask:
What systems do we depend on?
What information do we need to protect?
Who has access?
What would hurt the business most if it stopped working, was lost, or was exposed?
What scams or mistakes are most likely in our daily work?
What would we do if email, payroll, banking, or customer files were compromised?
What are the first three improvements we can make this month?
This doesn’t need to take weeks. Even a one-hour conversation can uncover important gaps. The goal isn’t to solve everything at once. The goal is to move from “we haven’t really thought about it” to “we know our biggest risks and we’re taking practical steps.”
A note about nonprofits
Nonprofits face many of the same cybersecurity pressures as small businesses, but the expectations often come through a different lens.
For nonprofits, the questions may come from boards, funders, donors, volunteers, community partners, insurers, or service providers.
The details may differ, but the core idea is the same: people are trusting the organization with information, money, access, and reputation. That trust needs to be protected.
Final takeaway
Cybersecurity expectations for small businesses are no longer unusual. Clients may ask about them. Insurers may ask about them. Vendors and partners may ask about them. Banks and payment processors may factor them into their risk decisions. Employees and customers may assume the business has basic protections in place.
That can feel like a lot. But the starting point doesn’t have to be complicated. Use multifactor authentication. Train your team. Protect important accounts. Back up critical data. Keep software updated. Limit access. Verify payment changes. Write down simple processes. Make it easy for employees to report something suspicious.
Small businesses don’t need to look like large corporations. But they do need to be ready for a world where cybersecurity is part of trust. And trust is already part of doing business.
