CISA Releases Updated Secure-by-Design Guidance for SMBs
CISA published updated Secure-by-Design guidance specifically tailored for small and medium-sized businesses, covering practical steps for implementing MFA, network segmentation, and incident response planning without enterprise-level budgets.
What CISA Published
The Cybersecurity and Infrastructure Security Agency (CISA) released an updated version of its Secure-by-Design guidance document specifically tailored for small and medium-sized businesses. The document, available free at cisa.gov, provides practical, actionable cybersecurity guidance that does not require enterprise-level budgets or dedicated security staff to implement. The guidance covers the most impactful security controls that SMBs can implement to significantly reduce their risk of a successful cyberattack.
Key Recommendations from the Guide
The CISA SMB guide prioritizes the following controls as having the highest impact for the lowest cost and complexity. Multi-factor authentication on all email accounts, remote access systems, and cloud services — CISA estimates that MFA prevents over 99% of automated credential attacks. Regular, tested backups stored offline or in immutable cloud storage — the most effective defense against ransomware. Keeping all software and operating systems patched and up to date — the majority of successful attacks exploit known, patched vulnerabilities. Employee security awareness training — human error remains the leading cause of security incidents. Basic network segmentation to isolate critical systems.
Free Resources Available to SMBs
CISA offers several free resources that SMBs can take advantage of immediately. The Cyber Hygiene Vulnerability Scanning service provides free external vulnerability scanning for your internet-facing systems. The Ransomware Readiness Assessment tool helps you evaluate your organization's preparedness for a ransomware attack. The Phishing Campaign Assessment service tests your employees' ability to recognize phishing emails. All of these services are available at no cost to U.S. businesses. Segler.Net can help you interpret the results and implement the recommended improvements.
- Download and review CISA's SMB Secure-by-Design guide — it's free and practical
- Implement MFA on all email accounts and remote access systems as a first priority
- Develop a basic incident response plan — even a simple one is far better than none
- Segment your network to isolate critical systems from general business traffic
- Use CISA's free cybersecurity resources including their vulnerability scanning service
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.