If you run a business alone, losing access to your email can mean losing access to your invoices, customer records and website on the same morning. The National Institute of Standards and Technology published a cybersecurity guide for businesses without employees in November. Two of its recommendations are especially useful for a one-person operation: protect the accounts that let you recover everything else, and test whether you can get your files back.
Start with the accounts that unlock the rest
Write down the accounts you would need to keep taking orders or getting paid if your computer disappeared. For an online shop, that might mean the email account that receives password resets, the store dashboard, the payment service and the domain registrar. A freelance bookkeeper might put the client portal and cloud file storage near the top. Add the name of each provider and where to find its official account recovery page. Keep the list somewhere you could reach without the computer.
NIST recommends using phishing-resistant multifactor authentication when an account offers it. A passkey or compatible physical security key can help prevent a fake login page from collecting a credential it can use on the real site. Start with your main email, password manager, financial accounts and cloud services that contain sensitive information. If a provider offers only an authenticator code or text message, turn on an available second factor and remember that a convincing phishing page can still ask you for a code.
Check how each service lets you sign in if your phone is lost. Some offer recovery codes or let you register a second device or security key. Store recovery codes securely where they remain accessible if your primary device is gone. If your email provider gives you recovery codes and your only copy is in that same inbox, you may have no way to retrieve them when you need them.
NIST also recommends unique passphrases of at least 15 characters where passwords remain necessary. A password manager makes it easier to give each service a different password. Use a standard computer account for daily work where possible and reserve the administrator account for changes that require it.
Back up files you can actually restore
The Federal Trade Commission’s small-business guidance recommends regular backups in the cloud or on an external drive. NIST also calls for protecting and testing those copies. Check what your existing cloud service does when you delete a file or replace it with a corrupted copy. If those changes sync across your devices, recovery depends on whether the service keeps previous versions or deleted files and for how long.
Start with records you would struggle to recreate, such as invoices, signed contracts or current orders. If a service holds the only copy, check whether it lets you export that data. Set a backup interval based on what you could afford to recreate. A weekly copy may work for files that rarely change. A shop taking orders every day could lose several days of records on that schedule.
Try restoring one file to a separate folder. Open it and check that it contains what you expected. If the backup requires a separate login or an encryption key, make sure you can reach it from another device. If you use an external drive, keep it disconnected between backups and protect it from theft. The FTC recommends encryption for storage that contains sensitive personal information.
Keep a paper copy of the phone numbers you would need if your email stopped working. NIST suggests including contacts for reporting attacks and getting professional help. Add the bank or payment processor you would call if money were at risk, and check whether client contracts or applicable rules set a deadline for reporting an incident. Keep the contact sheet with your recovery instructions, separate from the computer you use every day.
