Guides / Security, Backup & Access
Decision guide
Security, Backup & Access
Security, backup and access are three jobs: keeping the wrong people out, keeping your data recoverable, and keeping your website safe. This guide gives you a responsibility map and a thirty-day baseline, and explains what each tool class does and does not do.
- Five situationsEach with a way into Solutions
- About 9 minutes11 sections, jump to any
- Informational guideNot personalised advice
The short answer
Habits first, tools second. Start with the closest situation.
You have not turned on MFA anywhere
Start with email, administrator and finance accounts. Prefer an authenticator app or security key over text messages.
Multifactor authentication and account recovery in Solutions
Your team reuses passwords
Adopt a business password manager, protect it with two-step verification, and replace reused passwords starting with the most important accounts.
You have never tested a restore
Follow 3-2-1: three copies, two kinds of storage, one off-site. Test restoring a file and a full system, and keep copies the same login cannot delete.
You run a website that customers depend on
Keep software updated, limit admin accounts, back it up and know who acts on alerts. See the Hosting guide.
You are being sold a lot of security products
Map each product to something on the responsibility map. If it does not close a real gap, wait.
The responsibility map: four things to protect
Security advice fails when it is a list of products. Start with what you are protecting and who is responsible for each part, then choose tools for the gaps. Read across a row.
Show the table
| What you protect | Baseline practice | Tool class that helps | Who owns it |
|---|---|---|---|
| Access to accounts | Unique passwords for every account; multifactor authentication on email, admin and finance accounts first | Password manager; authenticator apps or security keys | You, for your accounts; the provider, for the sign-in system |
| Your data | Regular, automatic backups following 3-2-1, with restores tested | Backup and recovery services; cloud sync is not a backup | You, even when a provider stores the copies |
| Your website | Updates applied promptly; least-privilege admin accounts; backups; a way to detect changes | Site security and monitoring; managed hosting | Shared between you, your host and your developer; see the responsibility table in the Hosting guide |
| Your people | Basic training on phishing and account safety; a way to report mistakes without blame | Awareness training; email filtering | You |
Where this shows up in Solutions
Your first thirty days: a baseline in order
- List your critical accounts. Email, domain registrar, hosting, banking and payment providers, accounting, and any admin panel.
- Turn on multifactor authentication for those accounts, starting with administrators and anyone handling sensitive data.
- Adopt a password manager and replace reused passwords, starting with the most important accounts.
- Set up backups you can restore. Decide what needs backing up, automate it and run a test restore.
- Update everything that can be updated, including your website software, plugins and devices, and remove what you no longer use.
- Write down who does what. Who holds recovery details, who to call, and how to report a suspected incident.
None of this needs a large budget. It needs an owner and a calendar.
Where this shows up in Solutions
Access: passwords, multifactor authentication and password managers
Passwords alone are no longer enough. CISA’s small-business guidance says multifactor authentication (MFA) asks for two or more ways to verify identity, so that if one credential is compromised an attacker still cannot get in. It advises turning it on across systems such as email, file storage and remote access, starting with administrator accounts and employees who handle sensitive data.
- Not all MFA is equal. CISA ranks a physical security key as strongest and a code sent by text or email as the weakest, and recommends aiming for phishing-resistant MFA, which in practice means FIDO authentication.
- Use a password manager. The UK NCSC says a manager lets you have a unique password for each service, generates strong passwords, autofills only on the legitimate site, which helps against phishing, and can alert you to breaches. It recommends switching on two-step verification for the manager account itself and considering passkeys where available.
- Password rules have changed. NIST’s guidance recommends against forcing complexity mixtures or arbitrary periodic changes, recommends checking new passwords against lists of known-breached and common passwords, and says sites should allow pasting so password managers work.
- Plan for loss. Know how you recover the master password and the second factor before you need to.
Where this shows up in Solutions
Backup: the 3-2-1 approach and why testing is the point
CISA’s guidance for small and medium businesses is a good baseline: keep three copies of important files, on two different types of storage, with one copy off-site. Back up automatically and regularly, protect copies with physical security, encryption and offline copies, and test that you can restore both everything and individual files, including rolling back at least seven days.
- Sync is not backup. A synced folder copies deletions and corruption to every device. A backup keeps earlier versions.
- Backups need protecting too. CISA recommends physical security, encryption and keeping offline copies.
- Cover the whole business. Laptops, shared drives, your website and database, and any cloud services you cannot recreate.
- Know the time it takes. A restore that takes a week may be worse than the outage.
For websites specifically, see Hosting guide: Backups and recovery for the questions to ask a provider.
Where this shows up in Solutions
Habits first, tools second.
The tool classes
Security is sold as products, but most of the work is habit. These are the classes you will meet and what each does.
Show the table
| Class | What it does | What it does not do | Watch for |
|---|---|---|---|
| Password and access manager | Stores and fills unique passwords; shares credentials safely; may hold passkeys | Protect you if your master account is weak or unrecovered | Recovery process; sharing controls; export of your vault |
| Backup and recovery service | Copies data automatically and lets you restore it | Guarantee recovery if you never test | Where copies live; retention; restore speed; who can delete backups |
| Business VPN | Encrypts traffic between a device and the VPN’s network and can restrict access to internal systems | Make you anonymous, or protect you from phishing or malware | Marketing that promises more than a VPN provides |
| Website security and monitoring | Scans, filters bad traffic and alerts you to changes | Fix weak passwords or unpatched software on its own | Who acts on the alerts |
| Identity and two-factor tools | Central sign-in, MFA enforcement and account recovery | Replace basic hygiene | Cost and complexity for a small team |
Where this shows up in Solutions
What to evaluate
Recovery and export
Can you get your data or vault out, and recover access if you lose a device? This is your exit route.
Where data is stored and who can read it
Check encryption, storage locations and the provider’s access controls.
Ease of use for the whole team
Security you cannot use daily is not used. Test with your least technical colleague.
MFA and phishing resistance
Does it support the stronger methods, and enforce them for everyone?
Restore testing and reporting
Can you test restores easily and see clear reports of what was protected?
Separation from what it protects
Backups should not be deletable by the same account that an attacker would compromise.
Support when things go wrong
What happens in an incident? Check channels, hours and any recovery help.
Pricing model
Per user, per device or per gigabyte scale differently. Price the backup you actually need.
How security costs are structured
Prices change often, so this guide gives no figures. The structure is what lasts:
- Password managers are usually per user, with team features in higher plans.
- Backup services are usually priced by storage, devices or users, with retention affecting cost.
- VPNs and security services are usually per user or per device.
- Add-ons such as extra storage, longer retention and priority support.
- Your time. Set-up, training and restore tests.
- The cost of doing nothing. Downtime, recovery and, for some businesses, regulatory consequences.
Changing tools without a gap in protection
The risk in switching security tools is a moment when you are unprotected or locked out.
- Keep the old protection running until the new one is confirmed.
- Export your password vault to an encrypted file, import it, and delete the export securely.
- Take a fresh backup with the new tool and do a test restore before you cancel the old one.
- Re-enrol MFA where needed and update recovery details.
- Tell the team what changed and where to get help.
Common mistakes and warning signs
- Reusing passwords, or forcing frequent password changes that lead to weaker ones.
- MFA only on some accounts, or only by text message where a stronger option exists.
- Backups that have never been restored.
- Treating cloud sync as a backup.
Show 4 more
- Backups reachable by the same account an attacker would take over.
- Buying a VPN or scanner instead of fixing basics.
- No named owner for security, so nothing is reviewed.
- Fear-based marketing that promises complete protection.
Frequently asked questions
What is the most important thing to do first?
Turn on multifactor authentication for your email, administrator and finance accounts. Email is often the key to resetting everything else.
Is a password manager safe?
The UK NCSC recommends them as a better alternative to memorising or writing passwords, provided you protect the manager with a strong primary password and two-step verification. No tool removes all risk.
Is text-message MFA good enough?
It is better than a password alone, and CISA rates it the weakest of the common methods. Where you can, use an authenticator app or, better, a security key.
How often should I back up?
It depends on how much work you could afford to lose. Automate it, and set the frequency by how often your data changes. CISA recommends automatic, regular backups and testing restores.
Do I need a VPN?
A VPN can protect traffic on untrusted networks and control access to internal systems. It does not make you anonymous, and it does not stop phishing or malware. Decide by the specific problem it solves.
Do small businesses really get attacked?
Any business that holds customer data, takes payments or relies on online accounts is a plausible target. Basic controls such as MFA, updates and tested backups reduce the most common risks.
How often is this guide updated?
We review it when material information changes, and the review date is shown at the top. See How We Evaluate.
Ready to compare available providers?
This guide explains the decision. When you are ready to shortlist by business need, see Security, Backup & Access Solutions.
Sources and method
Sources and how we work (4 sources)
This guide is based on public documentation, standards and published sources, and on general industry practice. Provider claims, public documentation, published sources and our own observations are kept distinct, and where we have directly tested or used something, we say so explicitly. This guide names no products as recommendations. Figures that change are dated where they appear. Sources used:
- CISA: Require multifactor authentication MFA guidance for small and medium businesses.
- CISA: Back up business data The 3-2-1 approach, protection and restore testing.
- UK NCSC: Password managers Benefits, risks and recommendations.
- NIST SP 800-63B: Digital identity guidelines, authentication and lifecycle management Password length, complexity, blocklists and paste.
Read How We Evaluate for our criteria and the limits of what we claim. If you spot an error or an omission, please email info@kybervega.com.