Small Business Cybersecurity Services for Firms of 5 to 75 People
A small firm does not need an enterprise security program. It needs a short list of controls aimed at the attacks it will actually face, running on every laptop and account and checked by someone accountable. Small business cybersecurity services from NetSys are that list, run for you month to month.
The short answer
Small business cybersecurity services are the security controls a small firm runs every day, managed for it by an outside team. For firms of 5 to 75 people, NetSys runs endpoint detection and response, multi-factor authentication, email protection, Keeper, patching, immutable backups with restore tests and phishing training. Monitoring runs 24/7, and pricing is per user per month.
Closest related page: Managed cybersecurity services. That page covers our full security practice for businesses of any size; this one sets out the fixed baseline a 5 to 75 person firm runs, what it excludes and how it is priced.
Most small firms already own some security: antivirus that came with the laptops, the filtering built into Microsoft 365 or Google Workspace, a firewall from the internet provider. The trouble sits in between. Multi-factor authentication covers most people but not the owner, backups exist but nobody has restored one, and a former employee's login still works. Automated attacks look for exactly those gaps, at every business, whatever its size.
Small business cyber security services close the gaps and keep them closed. NetSys puts a defined baseline on every company device and account, then keeps it patched, monitored and reviewed with you. Our published case studies show two versions: a five-person office that needed a firewall, managed antivirus and scheduled maintenance, and a 20-seat organization running endpoint protection, MFA, email security, tested backups and phishing training.
Layers, in the order we add them
Identity comes first, because most break-ins start with a stolen password: multi-factor authentication for everyone, the owner included, and Keeper so passwords stop being reused. Devices come next, with ThreatDown EDR and Microsoft Defender for Business, scheduled patching and local administrator rights removed. Then email protection and phishing training, and finally backups that are immutable and restore-tested. Monitoring runs 24/7 over all of it.
What Our Small Business Cybersecurity Services Include
Assessment First
Start from what is running today, not from a product list.
- A baseline check of accounts, devices, email settings and backups as they are now
- The free remote external penetration test, limited to the external scope we agree, with findings that are yours either way
- Gaps ranked so missing MFA, stale accounts and unprotected computers are fixed first
- A per-user proposal for the baseline, with anything outside it listed separately
Accounts and Passwords
Where most break-ins begin.
- Multi-factor authentication on every account, executives included
- Keeper business password manager for each person, with shared team folders
- Entra ID Conditional Access in Microsoft 365, or 2-Step Verification enforced in Google Workspace
- A leaver's access removed the day they go
Computers and Devices
Every company machine held to the same standard.
- ThreatDown EDR and Microsoft Defender for Business on each one
- Patching on a set schedule, with actively exploited flaws fixed first
- Local administrator rights taken off everyday accounts
- Intune compliance rules, so a lost or unpatched laptop cannot reach company email
- A business-grade firewall in the office
Email and Staff Awareness
Filters stop a lot of phishing; trained people catch some of what gets through.
- Email threat protection in front of every mailbox
- SPF, DKIM and DMARC, so others cannot easily send mail as your domain
- Phishing training and simulated phishing emails on a recurring schedule
- Suspicious messages reported to our help desk and checked by an engineer
Backup and Recovery
The layer that decides how bad a ransomware day gets.
- Immutable backups that ransomware cannot encrypt or delete
- Independent backup of Microsoft 365 mail and files
- Restore tests on a schedule, with the time each one took written down
- A short incident plan: who to call, and what not to touch
Why small firms hand NetSys their security
Tell us how many people you have, whether you run Microsoft 365 or Google Workspace and what security is in place today. A NetSys engineer will tell you which gaps matter most. Call 845-203-3914 or request a call.
Who does the work: meet the NetSys team on our About page.
- Sized for 5 to 75 people, without paying for an enterprise stack you do not need
- More than 30 ransomware incidents handled in three years, every one fully recovered
- One team for security and, if you want it, the help desk too
- Month-to-month terms, like every NetSys agreement
- In business since 1998, with 98% client retention
Measured results from our case studies
Scope, process and planning details
Which cybersecurity page you need
This page sets out the fixed baseline for firms of 5 to 75 people. Larger programs and specific services are on these pages.
| Page | Use it when |
|---|---|
| This page: Small business cybersecurity | You are a firm of 5 to 75 people and want the fixed security baseline, what it leaves out and how it is priced. |
| Managed cybersecurity | You want security controls run for you every day: endpoint detection, identity and email protection, backups and response. |
| MSSP services | You are comparing managed security service providers, or want security run separately from whoever handles your IT. |
| Managed detection and response | Your question is about endpoint alerts: who investigates them, how fast, and who may isolate a device. |
| SOC as a service | You need sign-in, firewall, email and server logs collected in a SIEM and watched around the clock. |
| Cybersecurity consulting | You want an assessment, a ranked roadmap and written policies as a project, without handing over daily security work. |
Related pages: Managed cybersecurity · MSSP services · Managed detection and response · SOC as a service · Cybersecurity consulting.
Cyber security for small business: what is covered and what is not
The proposal lists every covered user and device. This is the usual boundary.
| Layer | Included | Not included |
|---|---|---|
| Accounts | MFA for every user, Keeper, sign-in policies and same-day removal of leavers | Personal accounts staff use outside work |
| Devices | EDR on every company computer, patching, compliance rules and a business-grade firewall | Personal phones and home computers not enrolled in management |
| Threat protection, domain authentication and phishing training | A promise that no phishing email ever reaches an inbox | |
| Backup | Immutable backups with scheduled restore tests | Data kept outside the systems named in the agreement |
| Monitoring | Monitoring runs 24/7 on covered devices | Live answers to routine requests outside staffed help-desk hours |
| Compliance | Evidence for insurance applications and client questionnaires | Formal audits, certifications and legal advice |
Not sure which of these an insurer, a customer or a regulator will ask you to prove? Start with our guide to cybersecurity requirements for small business.
No service can promise that an attack will never succeed. The aim is fewer successful attacks, and a tested way back when one gets through.
Industry requirements on top of the baseline
The baseline is the same for every firm. Some industries answer to rules that ask for specific controls or more evidence:
| Business | Rule that applies | What it adds |
|---|---|---|
| Medical and dental practices | HIPAA Security Rule | A current risk analysis, audit logs, encryption and business associate agreements |
| Tax preparers, mortgage brokers and other non-bank financial firms | FTC Safeguards Rule (16 CFR Part 314) | A written information security program, a Qualified Individual, MFA and testing |
| Insurance agencies, lenders and other New York DFS licensees | NYDFS 23 NYCRR 500 | A CISO, MFA for every user, an asset inventory, 72-hour incident notice and an April 15 filing |
| Law firms | ABA Model Rules 1.1 and 1.6(c) | Reasonable efforts to protect client information, wire-fraud controls and breach readiness |
| Defense suppliers | NIST SP 800-171 and CMMC | Controls for controlled unclassified information and a self-assessment score in SPRS |
| Any business holding New Yorkers' private information | NY SHIELD Act (GBL 899-bb) | Reasonable administrative, technical and physical safeguards |
Industry programs with their own pages: HIPAA compliance · cybersecurity for financial services · cybersecurity for law firms.
This is general information, not legal advice. Your counsel confirms which rules apply to your business.
How we put the baseline in place
Rollout is staged, a few people at a time, so any problem shows up in a small group first.
- Baseline check of accounts, devices, email settings and backups as they are today
- Quick fixes first: missing MFA, stale accounts and unprotected computers
- EDR, Keeper and email protection rolled out in small groups
- A first restore test and a first phishing simulation, with the results shared
- Regular reviews from then on of what was blocked, patched and still open
How small business cybersecurity is priced
Security is priced per user per month, on its own or inside an IT support agreement, and we do not publish figures. These inputs move the number.
- Number of users and company devices
- Security licenses you already own, such as Microsoft 365 Business Premium, which includes Defender for Business
- Compliance needs such as HIPAA, the FTC Safeguards Rule or an insurer's checklist
- Offices and on-site time, such as a firewall to manage at each site
- Whether you buy security alone or with IT support
Market-wide ranges, with their sources and dates, are in our post on what cybersecurity costs a small business.
Guides and checklists
Related guides and tools
- What cybersecurity costs a small business, with sources
- The controls that stop most small business attacks
- EDR vs antivirus vs MDR for small business
- The 2026 small business cybersecurity checklist
- Security awareness training and phishing simulation
- Ransomware protection and tested recovery
- Cybersecurity consulting for an assessment and plan
- IT support for small businesses
- Case study: a five-person office's security baseline
Small Business Cybersecurity FAQs
What cybersecurity does a small business need?
At minimum: multi-factor authentication on every account, endpoint detection and response on every computer, scheduled patching, email protection, a password manager and backups that have been restored in a test. Add phishing training and a short incident plan once those are running. The FTC's small business guidance and NIST's Small Business Cybersecurity Corner cover the same basics.
What is included in NetSys small business cybersecurity services?
MFA and sign-in policies on every account, Keeper for passwords and same-day removal of leavers; ThreatDown EDR and Microsoft Defender for Business, scheduled patching and Intune compliance rules on every company computer; a business-grade office firewall; email threat protection with SPF, DKIM and DMARC; phishing training; immutable backups with scheduled restore tests; and 24/7 monitoring of covered devices. Personal devices, formal audits and legal advice are outside it.
How does onboarding work?
We start with a baseline check of your accounts, devices, email settings and backups as they are today, and fix the quick gaps first: missing MFA, stale accounts and unprotected computers. EDR, Keeper and email protection then roll out a few people at a time, so a problem shows up in a small group. Onboarding ends with a first restore test and a first phishing simulation, with the results shared.
Who handles support and escalations?
NetSys engineers. Monitoring and emergency service run 24/7, and the help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern time. Suspicious messages reported to the help desk are checked by an engineer, severe-incident escalation is written into the agreement, and the short incident plan tells your staff who to call and what not to touch.
What should a small business cybersecurity plan include?
The controls on this page in the order they go in, meaning accounts, then devices, then email, then backups, with an owner for each and how often it is checked. Add the short incident plan, the rules your industry adds, such as HIPAA or the FTC Safeguards Rule, and a review date. Our 2026 small business cybersecurity checklist turns the same plan into a list you can work through.
How much should a small business spend on cybersecurity?
Enough to run the baseline controls properly, and the amount depends on headcount, devices, the licenses you already own and your compliance needs. NetSys prices security per user per month and does not publish a rate card. Our post on what cybersecurity costs a small business lists market ranges from named, dated sources if you want a benchmark.
Is antivirus enough for a small business?
No. Antivirus, even next-generation antivirus, focuses on malicious files, while many attacks use stolen passwords, phishing links or legitimate tools that no file scan flags. A small business also needs endpoint detection and response, which watches behavior, plus multi-factor authentication, patching and backups that have been restored in a test.
Do hackers really target small businesses?
Yes, mostly through automated attacks that never check company size. Bots try leaked passwords against every mailbox, scan the internet for unpatched devices and send phishing in bulk. Small firms are often easier to get into, and criminals use or sell that access whatever the victim's size. The baseline on this page is aimed at exactly those attacks.
More frequently asked questions
What does cyber insurance expect a small business to have?
Applications commonly ask about multi-factor authentication, endpoint detection and response, offline or immutable backups, patching and security training, though requirements vary by insurer and policy. We map your controls to the application's questions and provide the evidence. The underwriting decision stays with the insurer, and our cyber insurance readiness page covers the process.
Do you support small firms on Google Workspace?
Yes. The baseline is the same on either platform: multi-factor authentication, EDR on every computer, email protection, a password manager and tested backups. In Google Workspace we enforce 2-Step Verification and set sharing policies in the admin console; in Microsoft 365 we use Entra ID Conditional Access. Firms that run both get the baseline on each.
Find the gaps between the tools you already own.
Tell us your headcount, your email platform and the security you run today. We will compare it with the baseline on this page and tell you what to add first.