Not a security programme. The handful of things that prevent the incidents that actually happen to small companies.
12 min read · Level 3
The incidents that actually happen to small companies are unglamorous: a reused password in a public breach, a departed contractor with live access, a backup nobody ever restored from. None of them require a security programme — they require an afternoon. Startups are targeted precisely because they are unlikely to have done that afternoon, and enterprise customers will ask.
The basics that prevent most real incidents at small companies:
Unique passwords in a password manager, everywhere Two-factor authentication on email, cloud, code and banking Least privilege — people have access to what they need Offboarding that revokes access the same day Backups you have actually restored from Encryption in transit and at rest for customer data Knowing what personal data you hold and why
Because startups are targeted precisely because they are unlikely to have these in place, and because the most common incidents are unglamorous: a reused password, a departed employee with live access, a backup that never worked.
And because enterprise customers will ask. A security questionnaire is a normal part of B2B sales, and being unable to answer stalls deals for weeks.
The incidents that actually happen to small companies:
A founder reuses a password that appears in a public breach. An attacker gets into email, then uses password resets to reach everything else. Prevented by: a password manager and 2FA.
A contractor leaves and keeps access to the code repository for eight months because nobody had a checklist. Prevented by: an offboarding SOP.
A database is restored after a failure and turns out to be six weeks stale, because nobody ever tested a restore. Prevented by: restoring from backup once, deliberately.
An enterprise deal stalls for three weeks over a security questionnaire nobody can answer. Prevented by: writing the answers down before you need them.
None of these require a security team. All four are afternoons of work, and each prevents a category of incident that regularly kills or badly damages small companies.
First-time founders often defer all of this as something for larger companies. The basics take a day in total and prevent the great majority of realistic incidents.
The second mistake: backups that have never been restored. An untested backup is a belief, not a backup, and people find out at the worst possible moment.
The third: collecting personal data with no idea what you hold or why. Most jurisdictions require you to know, and it is far easier to establish early than to reconstruct later.
Unique passwords everywhere. This single step removes the most common attack path.
Email first — it is the reset path for everything else — then cloud, code and banking.
Every system to revoke, same day. Run it every time someone leaves, including contractors.
Until you have done it, you do not have backups. Diarise a repeat annually.
What, where, why, how long. Required in most jurisdictions and needed for any privacy policy that is accurate.
A one-page overview turns a three-week enterprise stall into a same-day reply.
Now. The basics take about a day and do not need to wait for scale.
Do not pursue formal certification early unless a specific deal requires it. It is expensive and slow, and the basics prevent far more real risk.
The failure mode is not the absence of backups, it is backups that have never been restored — discovered to be stale, partial or misconfigured at the exact moment they are needed. Restoring once, deliberately, is what converts a belief into a fact.
Restore from backup once on purpose, then annually. Until you have done it, you do not know whether you have backups.
Security review is a standard gate in B2B sales, and a small company that cannot answer stalls for weeks — not because the answers are bad, but because nobody has written them down. A one-page overview prepared in advance turns a three-week delay into a same-day reply.
Write the security overview before an enterprise deal needs it. It is a sales asset, not a compliance chore.
Create a free account to read the rest and apply it to your own startup.