You don't have an IT department. You have email, bank accounts, job files, and a reputation — which makes you exactly the kind of target cybercriminals love. This manual gives you the handful of basic, inexpensive measures that stop the vast majority of attacks on small businesses, in priority order, with checklists you can hand to your team.

It starts where the risk is: why contractors get hit (business email compromise, ransomware, invoice fraud, payroll diversion) and what an attack actually costs a 20-person firm. Then the weekend fix — passwords and multi-factor authentication — followed by one chapter a week: phishing and the non-negotiable financial verification rule, backups and the 3-2-1 rule, devices and updates, Wi-Fi, and email hardening.

The final chapters are the grown-up layer: vetting vendors and subs, a one-page incident response plan to print and post, and cyber insurance — including what to check before you buy. A 90-day program at the end sequences the whole thing, with seven printable checklists: the weekend fix, monthly and quarterly routines, new-hire and departure security, the annual review, and the incident one-pager.

The entire program costs under $2,000 a year for most firms. One prevented incident pays for decades.