Business security

Small business security stack

Sequence a short list of operable controls. Favor identity, endpoint, email authentication, and proven backups before niche platforms.

Updated Aug 2026

Start the checklist Methodology

Quick answer

Sequence a short list of operable controls. Favor identity, endpoint, email authentication, and proven backups before niche platforms.

Owners beat logo counts
Native suite controls first when they meet the need
Prove restores early

What this stack is for

For owner-operated teams, stack order usually beats buying five overlapping suites. Identity and email first, then device hygiene, then a shared vault, then only the leftover detection or compliance job you can operate.

Paid platforms do not replace owner hygiene. Use the business security assessment and security stack builder, then open a category page only for leftover work.

Build the free stack before paid seats

Turn on MFA for domain email, Microsoft 365 or Google Workspace admins, the domain registrar, banking, and payroll.
Publish SPF and DKIM, then start DMARC at p=none with a mailbox you actually read.
Enable OS updates, disk encryption, and the built-in antivirus on every company device.
Inventory shared passwords in chat or spreadsheets and assign one offboarding owner.
Name an owner for internet-facing assets and a critical-finding patch SLA before scanner demos.
Run the assessment and stack builder, then open only the category worksheet that matches leftover work.

Recommended stack order

Order by blast radius and operator time, not by a catalog of logos.

Identity and email: MFA, legacy auth off, DMARC reporting, one phishing triage owner
Endpoint hygiene: patch, encrypt, remove standing local admin, healthy OS antivirus
Shared vault: revoke-on-exit shares instead of passwords in chat (see business password managers)
Inventory leftover: vulnerability assessment before buying another scanner console
Detection leftover: EDR or MDR only when alerts would otherwise sit unread
Compliance leftover: evidence owners and control mapping before buying a GRC logo

Where to look next

Use workflows before vendor shopping. Do not paste passwords, keys, exact IP lists, or vault exports into worksheets.

What to do

Finish MFA, DMARC reporting, device hygiene, and inventory ownership first. Paid seats only for leftover work you can operate. Record the constraints in the business security checklist.

How to apply this guide

Stabilize identity

MFA, offboarding, and a business password manager.
Cover devices

MDM baselines and endpoint protection on every laptop.
Harden email and backup

Authentication, phishing controls, and restore drills.
Add monitoring you can staff

Native alerts or MDR if nights are uncovered.

Action checklist

Named owners for identity and backup
MFA enforced on email and IdP
Endpoint agent coverage percentage known
DMARC policy decision documented
Restore drill completed in the last quarter

Record decisions in the checklist

Keep constraints and owners in one place while you compare options.

The checklist is a static worksheet on this site. No account required.

Open the business security checklist Read the methodology

Frequently asked questions

How should we start a small business stack purchase?

Write the outcomes, integrations, and staffing model first. Then shortlist three to five products against the same worksheet instead of chaining demos.

Do you publish a product score on this page?

No. This is planning and buying guidance. Compare vendors against your own requirements until a published review exists.

Do you cover only large enterprises?

No. Much of this research is written for small and mid-sized organizations, MSPs, and teams without a full SOC, with notes when enterprise-only constraints apply.

Where should I start?

Start with the live checklist, then use the tools directory and the category hubs that match leftover jobs.

Related live research

guide