| Customer asks for | Framework to pursue | Time to first audit | Cost (audit + tooling) |
|---|
| SOC 2 Type II (most common for B2B SaaS) | SOC 2 (AICPA Trust Services Criteria) | 6-12 months | $25,000-$80,000 first year |
| Healthcare BAA / HIPAA audit | HITRUST CSF or HIPAA Security Rule assessment | 3-6 months | $15,000-$40,000 |
| Government contract or FedRAMP path | CMMC Level 2 (if DoD) or NIST 800-171 | 6-18 months | $40,000-$150,000 |
| EU customer / GDPR vendor review | ISO 27001 + DPA template | 9-15 months | $50,000-$120,000 |
| PCI DSS (if you process cards) | PCI DSS 4.0 (mandatory March 2025) | 3-9 months | $10,000-$50,000 depending on volume |
The fastest first framework for most small businesses is SOC 2 Type II. A well-run 12-month implementation costs less than one month of a senior security engineer and unlocks the largest set of enterprise sales conversations. Start with the free SOC 2 Lite self-assessment from AICPA, get to a Type I in three months, then chase Type II.
Common Mistakes That Sink Small Companies
- Antivirus-only defense. Modern threats evaded traditional antivirus years ago. Replace it with EDR.
- No backups or untested backups. The first question after a ransomware incident is always "do you have tested backups?" If the answer is no or unsure, the company is in serious trouble.
- Skipping MFA. Microsoft data shows MFA blocks 99.9% of automated account-takeover attacks. It is free and quick to enable.
- Phishing training skipped or stale. Employees trained once years ago fall for modern lures. Refresh quarterly with new simulations.
- No incident response plan. An unwritten plan is no plan. The stress of an incident will leave your team unable to improvise what should have been documented.
- Ignoring vendor risk. A compromised vendor can be the entry point for an SMB breach. Maintain an inventory of vendors with data access and require security questionnaires.
When to Move from DIY to Outside Help
Three triggers:
- Enterprise customers ask for security audits. When SOC 2, ISO 27001, or PCI DSS becomes a deal requirement, hire a vCISO to drive the readiness program.
- You cannot staff 24/7 monitoring. Engage an MDR provider to handle alert triage and active response.
- An incident occurs. Outside IR support — pre-arranged via retainer — dramatically shortens recovery time.
For the defensive habits every employee should adopt, see our 25 cybersecurity tips. For the cyber insurance choices that fund response, see our cybersecurity insurance guide. To build the security leadership that a small company needs, the TutorsBot Cyber Security Analyst Foundation course covers detection, response, and program foundations.
Small Business Cybersecurity FAQ 2026
What is the single most important cybersecurity control for a small business in 2026? Multi-factor authentication on every account that touches email, identity, code, or money. The Verizon DBIR 2025 lists stolen credentials as the #1 initial access vector across all breach sizes. MFA blocks 99.9% of automated credential attacks, per Microsoft research.
How much should a 20-person company spend on cybersecurity in 2026? The rule of thumb from ConnectWise and Kaseya SMB surveys is 1.5-3% of revenue, with a floor of $1,500/year for the smallest companies. That covers MFA, EDR, backups, basic training, and cyber insurance. Below $1,500 you are almost certainly under-insured for a single breach.
Do I need a vCISO or is a managed security provider enough? For most sub-50-person companies, a managed security provider (MDR) plus an annual vCISO engagement (8-16 hours a quarter) is the right balance. The MDR handles 24/7 monitoring; the vCISO handles strategy, board reporting, and audit prep. Expect $1,500-$4,000/month for MDR and $400-$800/hour for vCISO.
Is Windows Defender enough as my EDR in 2026? For sub-20-person companies, yes. Microsoft Defender for Business now includes EDR, attack surface reduction, and managed hunting at $3/user/month (as of the late-2025 price cut). For larger companies or higher-risk industries, CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint P2 add threat hunting and rollback.
How often should I run phishing simulation? Monthly for high-turnover industries (retail, hospitality, healthcare), quarterly for stable office environments. The most actionable format is one-click simulated phishing with a 60-second training page; longer modules have negligible effect on click rates.
When do I need a SIEM? Almost never for sub-100-person companies. The TCO of a SIEM (Splunk, Sentinel, Sumo, Elastic) runs $30,000-$200,000/year and most SMBs lack the staff to operationalize the alerts. EDR + cloud-native logs (M365, Google Workspace, AWS CloudTrail) cover 80% of detection value at 10% of the cost.
Related Guides
Fazlur Rahman
