Cybersecurity Requirements for Small Business: What Applies

Most owners meet the phrase "cybersecurity requirements" in one of three moments: a client sends a security questionnaire, an insurer's renewal application asks whether every computer runs endpoint detection, or a regulator's letter names a rule you have never read. This guide sorts those demands into a map you can act on, with the official text linked for each rule, and then sets out the baseline that sits under all of them. If you want the baseline run for you, our small business cybersecurity service is that work, month to month. This is general information, not legal advice; your counsel confirms which rules apply to your business.

What are cyber security requirements for a small business?

A cybersecurity requirement is a control or practice that someone outside your business can hold you to: a regulator, a customer, an insurer or a court. That outside party is what separates a requirement from good advice. The requirements a small business faces come from three sources, and most firms have obligations from all three at once.

Source	Who sets it	Examples	What happens if you fall short
Law and regulation, by industry and by state	Federal agencies, state regulators and state legislatures	HIPAA for medical practices, the FTC Safeguards Rule for tax preparers and lenders, NYDFS Part 500 for insurance agencies, PCI DSS for anyone taking cards, breach notification laws in every state	Enforcement actions, fines, mandatory notifications, and in some rules an annual filing you cannot sign truthfully
Contracts and customers, including cyber insurance	The people who pay you and the carrier that insures you	Security questionnaires, flow-down clauses in a government or enterprise contract, a HIPAA business associate agreement, the controls an insurance application asks you to confirm	Lost deals, a contract you are in breach of, or a claim that is disputed because the application answers did not match reality
The baseline every business needs	Nobody in particular, which is why it gets skipped	Endpoint protection, tested backups, a business firewall, authenticated email, patching on a schedule	The attacks that hit small businesses most often succeed: ransomware, business email compromise, stolen passwords

The first two sources tell you what to prove. The third is what you have to run every day so the proof exists. The rest of this guide takes them in that order.

Which cybersecurity requirements apply by industry? A table by driver

Each row below is one rule, who it covers, what it asks for in practice and a link to the official text. We checked every source on November 7, 2026. The internal links go to the NetSys page that covers the work for that rule.

Driver	Who it covers	What it requires in practice	Official source
HIPAA Security Rule (45 CFR Part 164, Subpart C)	Medical, dental and other covered entities, and the business associates that handle their electronic protected health information	Administrative, physical and technical safeguards, a security risk analysis, organizational requirements such as business associate agreements, and written policies and documentation	45 CFR 164 Subpart C (Cornell LII copy of the regulation)
FTC Safeguards Rule (16 CFR Part 314)	Non-bank financial institutions under FTC jurisdiction: tax preparers, mortgage brokers and lenders, dealers that finance vehicles, collection agencies, check cashers and similar firms	A written information security program with a Qualified Individual, a written risk assessment, access controls, encryption, multi-factor authentication, staff training, a written incident response plan, an annual written report to the board, and notice to the FTC within 30 days of a breach affecting 500 or more consumers	FTC: Safeguards Rule, what your business needs to know
NYDFS Part 500 (23 NYCRR 500)	Companies licensed by the New York Department of Financial Services: insurance agencies and brokers, lenders, mortgage companies, money transmitters and others	A cybersecurity program and policy, a CISO function, risk assessment, multi-factor authentication, vulnerability management, an incident response plan, notice to the superintendent within 72 hours of determining a cybersecurity incident occurred, and by April 15 each year a certification of material compliance or an acknowledgment of noncompliance signed by the highest-ranking executive and the CISO	23 NYCRR 500.17 and 500.19 (Cornell LII)
SEC Regulation S-P (2024 amendments)	SEC-registered investment advisers, broker-dealers, investment companies and transfer agents	Written policies for an incident response program that detects, responds to and recovers from unauthorized access to customer information, notice to affected individuals as soon as practicable and no later than 30 days after becoming aware, and oversight of service providers; compliance was phased in, 18 months after the June 3, 2024 Federal Register publication for larger entities and 24 months for smaller ones, so both dates have passed	SEC press release 2024-58 and the rule page
CMMC and FAR 52.204-21	Defense contractors and subcontractors whose systems hold federal contract information (FCI) or controlled unclassified information (CUI)	The 15 basic safeguarding requirements of FAR 52.204-21 for FCI, assessed at CMMC Level 1 by self-assessment; NIST SP 800-171 for CUI at Level 2; and under DFARS 252.204-7021 a current CMMC status at the level named in the contract for its whole term, with an annual affirmation in SPRS and flow-down to subcontractors	FAR 52.204-21 and DFARS 252.204-7021
PCI DSS for card data	Any business that stores, processes or transmits payment card data, whatever its size, plus the service providers that can affect that data	The PCI DSS v4.0.1 requirements for the systems that touch card data; most small merchants validate with a Self-Assessment Questionnaire matched to how they take cards, and the payment brands and the acquiring bank decide what validation is required	PCI Security Standards Council: PCI DSS and its merchant guidance
State breach notification laws, including the NY SHIELD Act	Every business that holds personal information about a state's residents, in every state, the District of Columbia, Puerto Rico and the Virgin Islands	Notice to affected residents after a breach, and usually to the state attorney general; New York requires notice in the most expedient time possible and within 30 days of discovery, with notice to the attorney general, the Department of State and the State Police, and its SHIELD Act adds a duty to keep reasonable safeguards	FTC Data Breach Response guide and NY General Business Law 899-aa

Two patterns are worth seeing across the rows. Every rule wants a written program and a risk assessment, not just tools. And every rule sets a clock after an incident: 30 days under the FTC rule and Regulation S-P, 72 hours under NYDFS Part 500, 30 days under New York's breach law. You cannot meet a clock you have never rehearsed, which is why a short incident plan belongs in the baseline.

What are the cyber security requirements for government contractors?

For a small defense supplier the requirements follow the data. Federal contract information is non-public information provided by or generated for the government under a contract. Controlled unclassified information is the more sensitive category that carries its own marking and handling rules. Which one you hold decides your level.

FAR 52.204-21 lists 15 basic safeguarding requirements for systems that hold FCI, and the clause flows down to subcontractors other than those supplying commercially available off-the-shelf items (FAR 52.204-21, checked on November 7, 2026). The 15 cover access limits, identifying and authenticating users and devices, sanitizing media, physical access, boundary protection and separating public-facing systems, correcting flaws in a timely manner, malware protection kept current and periodic scans. Our CMMC Level 1 checklist walks through each one with the Microsoft 365, Entra ID and Intune settings that satisfy it and the evidence to keep.

DFARS 252.204-7021 is where CMMC becomes a contract term. The clause requires the contractor to "have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher," with the contracting officer naming Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC); it also requires an affirming official to affirm continuing compliance in SPRS each year, and it must be flowed down to subcontracts that involve FCI or CUI (DFARS 252.204-7021, checked on November 7, 2026). Level 1 allows no open items: all 15 requirements must be met before you can enter a passing self-assessment. The Department's rollout schedule for the higher levels has shifted during 2026; our CMMC compliance service page tracks the current status and sets these controls up for small contractors.

What are the cybersecurity requirements for financial services companies?

Three regulators write cybersecurity rules that reach small financial firms, and which one applies depends on who licenses or registers you. A tax preparer, a mortgage broker or a dealer that arranges financing answers to the FTC Safeguards Rule. An insurance agency or a lender licensed in New York answers to NYDFS Part 500. A registered investment adviser or broker-dealer answers to the SEC under Regulation S-P. Some firms answer to two of them.

The three rules overlap more than they differ. All of them expect a written program built on a risk assessment, controls on who can reach customer information, an incident response plan and oversight of the vendors that hold your data. The FTC rule and Part 500 name multi-factor authentication outright. The deadlines differ: 30 days to notify the FTC of a breach affecting 500 or more consumers, 72 hours to notify the New York superintendent of an incident, and 30 days to notify affected customers under Regulation S-P (sources in the table above, checked on November 7, 2026). Part 500 also has a small-company limited exemption for a covered entity with fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets, but an exempt firm still owes a cybersecurity program and policy, access privileges, a risk assessment, a third-party service provider policy, multi-factor authentication, an asset inventory, training and the 72-hour and April 15 notices (23 NYCRR 500.19).

Our cybersecurity for financial services page covers how NetSys runs these controls for small firms, and the SEC cybersecurity page for RIAs covers the Regulation S-P work in particular. Both compliance dates under Regulation S-P have passed, so an adviser that has not adopted its incident response program is late, not early.

What do contracts, customers and cyber insurers require?

The second source of requirements is private, and for many small businesses it arrives before any regulator does. A larger customer sends a vendor security questionnaire before signing. A prime contractor flows its own obligations down to you. A medical practice asks its IT provider to sign a business associate agreement. Each of these is a promise, and the questionnaire answers you give become something the customer can hold you to.

Cyber insurance works the same way. The application asks a fixed set of questions, and they are almost always the same ones: is multi-factor authentication on email, remote access and administrator accounts; does every endpoint run endpoint detection and response; are backups kept separate from the network, protected from deletion and tested; is email filtered; are systems patched on a schedule. Carriers treat the answers as representations about your business, so an answer that is true for most computers but not all of them is a problem to fix before you sign, not after a claim. Our guide to cyber insurance requirements for small business goes through the application question by question, and the MFA requirements post covers the control carriers ask about first. Coverage and premium decisions stay between you and your carrier; what NetSys does is put the controls in place and keep the evidence.

What is the baseline every small business needs? The NetSys Essentials stack

Strip away the industry rules and the questionnaires and the same five controls are left on every list. They are what an average small business needs whatever it does, and they are what the regulators and insurers above are usually asking about in their own words. NetSys packages them as the NetSys Essentials stack: five controls that NetSys installs, runs and reports on, so the evidence exists when someone asks for it. NetSys covers all five; none of them is left for you to run.

Control	What NetSys installs and runs	The evidence you can show
Device protection	EDR or MDR on every endpoint; our preferred platform is ThreatDown MDR	An enrollment report that matches the device inventory, and alert records
Backups with a tested restore	Datto or Barracuda for servers and workstations, with retention or backup for Microsoft 365 data	The restore test log with dates and times
A business firewall	Cisco Meraki or Cisco, managed and monitored	The configuration export and firmware version
Email on your own domain, authenticated and filtered	SPF, DKIM and DMARC published and enforced, with filtering in front of every mailbox	Your DNS records and DMARC reports
Regular updates	Operating system, application and firmware updates on a stated cadence	The patch report by device and the exceptions list

Identity controls such as multi-factor authentication sit alongside the stack and are covered on our multi-factor authentication page. The sections below take each of the five in turn: what it is, why insurers and regulators ask for it, and what "done" looks like.

Device protection: EDR or MDR on every endpoint

What it is. Endpoint detection and response (EDR) is software on each computer that records what processes, connections and sign-ins are doing and can stop or isolate a machine when the behavior looks like an attack. Managed detection and response (MDR) adds people: analysts who watch those signals around the clock and act on them. ThreatDown, our preferred platform, describes its MDR service as analysts monitoring your environment around the clock from a single lightweight agent that covers Windows, macOS and Linux (ThreatDown Managed Detection and Response, checked on November 7, 2026). Our managed detection and response page explains who monitors, who responds and who decides.

Why insurers and regulators ask for it. Insurance applications ask for endpoint detection on every endpoint because ransomware starts on one. FAR 52.204-21 requires protection from malicious code, kept current, with periodic and real-time scans. HIPAA's technical safeguards and the FTC rule's monitoring and testing elements are met in practice with the same tool.

What done looks like. Every company-owned computer and server is enrolled, the enrollment list is reconciled against the device inventory every month, alerts go to a named responder, and you have agreed in writing which containment actions NetSys may take without calling first. A machine that was never enrolled is the one that gets you.

Backups with a tested restore

What it is. A backup is a separate copy of your data and systems that an attacker who has your network cannot reach, encrypt or delete, plus a proven way to bring it back. NetSys works with Datto or Barracuda for servers and workstations. For Microsoft 365, the right wording is retention or backup for Microsoft 365 data, because the two are different things. Microsoft Purview retention policies keep content in place: when someone edits or deletes a file or message under a retention policy, a copy is retained in the SharePoint Preservation Hold library or the Exchange Recoverable Items folder (Learn about retention policies and retention labels, Microsoft Learn, checked on November 7, 2026). That preserves data, but it is not a third-party backup and it is not a restore tool. Microsoft 365 Backup is a separate, consumption-billed Microsoft service that backs up SharePoint sites, OneDrive accounts and Exchange mailboxes to append-only restore points and can roll a site or mailbox back to a prior point in time (Overview of Microsoft 365 Backup, Microsoft Learn, checked on November 7, 2026). Which of the two a firm needs depends on how long it must keep data and how fast it must recover, and NetSys sets up whichever the scope calls for.

Why insurers and regulators ask for it. The insurance application asks whether backups are offline or otherwise protected from deletion, and whether you have tested a restore, because paying a ransom is the alternative. Regulators ask how you would recover: HIPAA's administrative safeguards and the incident response plans required by the FTC rule, Part 500 and Regulation S-P all assume you can.

What done looks like. Each critical system has a written recovery time and recovery point target, at least one copy is immutable or offline, Microsoft 365 mail and files are covered by retention or backup that matches your retention needs, and a restore is tested on a schedule with the time it took written down. A backup that has never been restored is a hope, not a control. Our disaster recovery page covers the design.

A business firewall

What it is. A business firewall is a managed device at the edge of your office network that controls what comes in and goes out, separates guest and staff traffic, logs connections and gives remote workers a protected way in. NetSys installs and manages Cisco Meraki or Cisco firewalls. The router your internet provider supplied is not one, and neither is a device nobody has logged into since it was installed.

Why insurers and regulators ask for it. FAR 52.204-21 requires you to monitor, control and protect communications at the external boundary of your systems and to keep publicly accessible components on separate subnetworks. PCI DSS starts with network security controls around the systems that touch card data. Insurers ask about remote access and open ports because exposed remote desktop services are a common way in.

What done looks like. A supported business-grade firewall with current firmware, logging turned on and reviewed, guest Wi-Fi separated from company systems, remote access through a VPN or an identity-aware method rather than a port left open to the internet, and a configuration backup so the device can be replaced in hours. Our managed firewall page covers the ongoing work.

Email on your own domain with authentication and filtering

What it is. Business email means every employee sends from an address at your company's domain through a business platform such as Microsoft 365 or Google Workspace, not from consumer mailboxes. Three DNS records then prove to the world which servers may send as your domain. SPF lists the authorized senders, DKIM signs each message, and DMARC ties the two to the visible From address and tells receiving systems what to do with mail that fails. Microsoft describes DMARC as validation that "helps prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks," and recommends moving the policy from monitor-only to quarantine and then to reject once reports show legitimate mail passing (Set up DMARC to validate email in Microsoft 365, Microsoft Learn, checked on November 7, 2026). Filtering in front of every mailbox catches the phishing and malware that arrive from outside.

Why insurers and regulators ask for it. Business email compromise is where wire fraud starts, and insurers ask about email filtering and authentication for that reason. A mail domain without DMARC lets anyone send invoices as you. Rules that require staff training and monitoring, such as the FTC Safeguards Rule, assume the mail system itself is doing its share.

What done looks like. All company mail is on the company domain, SPF and DKIM are published for every service that sends as you, DMARC is at quarantine or reject with the reports going to a mailbox someone reads, filtering sits in front of every mailbox, and staff know where to report a suspicious message. Our email security page covers the setup.

Regular updates: operating systems, applications and firmware

What it is. Patching is applying the security fixes vendors release for operating systems, the applications on top of them and the firmware inside firewalls, switches, access points and printers. The cadence matters as much as the act: a stated schedule, a faster lane for flaws that are already being exploited, and a list of exceptions with an owner and a date.

Why insurers and regulators ask for it. FAR 52.204-21 requires you to identify, report and correct system flaws in a timely manner. Part 500 has a vulnerability management section, and the FTC rule requires monitoring or periodic testing of your safeguards. Insurers ask how quickly critical patches are applied because unpatched edge devices and servers are a leading cause of the claims they pay. CISA's Known Exploited Vulnerabilities catalog is the public list of flaws being used in real attacks, and CISA recommends organizations prioritize remediation of the vulnerabilities it lists (CISA Known Exploited Vulnerabilities Catalog, checked on November 7, 2026).

What done looks like. A workable cadence for a small business is operating system and application security updates at least monthly, flaws on the CISA Known Exploited Vulnerabilities list handled ahead of the monthly cycle, firmware on firewalls and network gear reviewed at least quarterly, and anything the vendor no longer supports replaced or isolated. The patch report shows every device, the date it was last updated and the open exceptions. Our patch management page covers how the schedule runs.

How do you work out which requirements apply to your business?

Six steps turn the map above into a list with owners. Most small firms can finish the first four in an afternoon with the owner, the bookkeeper and whoever handles IT in the room.

1. List the data you hold. Patient records, tax returns, card numbers, Social Security numbers, customer financial information, government contract documents. Each category points at a row in the table.
2. List who licenses or registers you. A state insurance or banking license, SEC or state registration, a healthcare license, a federal contract number. Each regulator brings its rule.
3. Pull the contracts and the insurance application. Read the security clauses in your largest customer contracts, any business associate agreement you have signed and the questions on your last cyber insurance application. Write down every control they name.
4. Map the result to the table and the baseline. Every requirement you found is either one of the five baseline controls, a written program and risk assessment, a notification clock, or something specific to one rule. Mark which.
5. Check the baseline against reality. For each of the five controls, find the evidence: the enrollment report, the restore log, the firewall configuration, the DNS records, the patch report. Where there is no evidence, there is no control. A cybersecurity risk assessment does this with an engineer and ranks the gaps; our small business cybersecurity checklist is the do-it-yourself version.
6. Assign an owner and a date to each gap. Requirements are met by named people on a schedule. The written program that most rules want is, in the end, this list kept current.

Frequently asked questions

Is there one federal cybersecurity law that covers every small business?

No. The United States regulates cybersecurity by sector and by data type, so a small business picks up obligations according to what it does and what it holds. Healthcare has HIPAA, non-bank financial firms have the FTC Safeguards Rule, SEC registrants have Regulation S-P, defense suppliers have CMMC and the FAR clause, and anyone taking cards has PCI DSS through their card agreements. State breach notification laws apply to everyone, and some states, New York among them, add a general duty to keep reasonable safeguards.

What are the FTC Safeguards Rule requirements?

A written information security program with nine elements: a Qualified Individual who runs it, a written risk assessment, safeguards including access controls, encryption, multi-factor authentication and secure disposal, regular testing or continuous monitoring, staff training, oversight of service providers, a program that is kept current, a written incident response plan, and an annual written report to the board or a senior officer. The rule also requires notice to the FTC within 30 days of discovering a breach of unencrypted information affecting 500 or more consumers. Our FTC Safeguards Rule service page sets out how NetSys puts each element in place.

Do the NYDFS 500 cybersecurity requirements apply to a small insurance agency?

Yes, if the agency holds a DFS license, though a small agency may qualify for the limited exemption in section 500.19 when it has fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets, counting affiliates. The exemption removes some sections, not the rule: an exempt agency is relieved of the CISO, audit trail, encryption and incident response plan sections among others, but it still owes a cybersecurity program and policy, access privileges, a risk assessment, a third-party service provider policy, multi-factor authentication, an asset inventory and training, and it still gives the 72-hour incident notice and files by April 15 each year. The details are in our NYDFS Part 500 guide for small firms.

What are the SEC cybersecurity requirements for a small RIA?

Under the 2024 amendments to Regulation S-P, a registered investment adviser needs written policies and procedures for an incident response program that can detect, respond to and recover from unauthorized access to customer information, must notify affected individuals as soon as practicable and no later than 30 days after becoming aware of such access, and must oversee the service providers that hold customer information. Smaller entities had 24 months from the June 2024 Federal Register publication, so the deadline has passed. Our Regulation S-P guide covers what to do now.

Does a small business need a written information security plan?

If the FTC Safeguards Rule applies to you, yes: the rule requires a written program, and tax and accounting firms usually call that document a WISP. Other rules expect written policies and documentation too, and insurers and customers ask for them. Even where no rule requires one, a short written plan that names the five baseline controls, who owns each and how often each is checked is the cheapest piece of evidence you will ever produce. Our WISP guide for tax and accounting firms covers the FTC version.

Does cyber insurance count as a cybersecurity requirement?

In practice, yes. The policy is a contract, the application is part of it, and the controls you confirm on the application are what the carrier expects to find if there is a claim. The questions carriers ask overlap almost completely with the five baseline controls plus multi-factor authentication, which is why a firm that runs the baseline finds the application easy to answer truthfully. Whether a given answer affects coverage is a question for your broker and the policy wording.

What does NetSys mean by the Essentials stack?

The five controls above, installed and run by NetSys for a small business: EDR or MDR on every endpoint with ThreatDown MDR as our preferred platform, backups with a tested restore through Datto or Barracuda plus retention or backup for Microsoft 365 data, a Cisco Meraki or Cisco business firewall, email on your own domain with SPF, DKIM, DMARC and filtering, and operating system, application and firmware updates on a stated cadence. NetSys covers all of it and reports on it, so the evidence a regulator, customer or insurer asks for already exists.

If we run the Essentials stack, are we compliant?

No, and nobody should tell you otherwise. The stack is the technical baseline that every rule and every insurer assumes. Compliance with a specific rule also needs the written program, the risk assessment, the training, the vendor oversight, the notification procedures and the evidence that rule asks for, and in some cases a filing or an independent assessment. The baseline makes those pieces achievable; it does not replace them, and NetSys does not promise certification, coverage or a passed audit.

Talk to an engineer about the Essentials stack

If you want the baseline run for you, bring your user count, what runs on your computers today for antivirus or EDR, how you back up, the make of your firewall and your email platform. Talk to an engineer about the Essentials stack and we will review what is already in place, what is missing and what the stack would change, before anything is proposed. For a broader review that ranks every gap, scope a cybersecurity risk assessment instead.

Sources

Checked on November 7, 2026.

• 45 CFR Part 164, Subpart C: Security Standards for the Protection of Electronic Protected Health Information, Cornell Legal Information Institute copy of the HIPAA Security Rule.
• FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission: program elements, covered businesses and the 30-day notification event rule.
• 23 NYCRR 500.17, Notices to Superintendent and 500.19, Exemptions, Cornell Legal Information Institute: the 72-hour notice, the April 15 filing and the limited exemption thresholds.
• SEC Adopts Rule Amendments to Regulation S-P, press release 2024-58, and the Regulation S-P rule page with the June 3, 2024 Federal Register publication date and the fact sheet stating the 18-month and 24-month compliance periods.
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems: the 15 requirements and the subcontract flow-down.
• DFARS 252.204-7021, Cybersecurity Maturity Model Certification Requirements: the current CMMC status requirement, levels, annual affirmation and flow-down.
• PCI DSS and PCI SSC merchant resources, PCI Security Standards Council: intended audience, Self-Assessment Questionnaires and who sets validation requirements.
• Data Breach Response: A Guide for Business, Federal Trade Commission: breach notification laws in all states, the District of Columbia, Puerto Rico and the Virgin Islands.
• New York General Business Law 899-aa: notice to residents within 30 days of discovery and notice to the attorney general, Department of State and State Police.
• ThreatDown Managed Detection and Response: around-the-clock analyst monitoring from a single agent.
• Learn about retention policies and retention labels, Microsoft Learn: retention keeps content in place and retains copies in the Preservation Hold library and Recoverable Items.
• Overview of Microsoft 365 Backup, Microsoft Learn: covered workloads, append-only restore points and consumption billing.
• Set up DMARC to validate email in Microsoft 365, Microsoft Learn: what DMARC checks and the staged rollout to reject.
• Known Exploited Vulnerabilities Catalog, CISA: the catalog and the recommendation to prioritize remediation.