Cybersecurity - PassPack

As a business owner, it's important to understand the risks of operating online and to have a plan in place to protect yourself, your customers, and your data from cyber threats. The Federal Communications Commission (FCC) recognizes the importance of cybersecurity for small businesses and has created resources to help you develop a customized plan. In October 2012, the FCC re-launched the Small Biz Cyber Planner 2.0, an online tool to help small businesses create a plan that works for them. The FCC also released an updated one-page Cybersecurity Tip Sheet with new tips on creating a mobile device action plan and on payment and credit card security.

Below is a summary of helpful cybersecurity advice for SMBs:

Cybersecurity and Infrastructure Security Agency (CISA): “Level Up Your Defenses — Four Cybersecurity Best Practices for Businesses” — practical, widely accepted advice on logging, backups, encryption, and incident reporting. CISA cybersecurity best practices (covering business defenses)
CISA: “Four Cybersecurity Essentials for Businesses” — another CISA fact sheet with recommended practices like phishing training, strong passwords, MFA, and software updates. CISA four cybersecurity essentials guide
Sophos Cybersecurity Best Practices Toolkit — a collection of best practice resources and cheat sheets created by a security vendor. Sophos cybersecurity best practices toolkit
NIST Special Publication 800-53 (Security and Privacy Controls) — an authoritative catalog of security controls from the U.S. National Institute of Standards and Technology, used across industries. Wikipedia: NIST SP 80053 (controls framework)
ISO/IEC 27005 (Risk Management Standard) — international guidance on identifying and managing information security risks. Wikipedia: ISO/IEC 27005 risk management guidance
CIS Reasonable Cybersecurity Guide — a detailed publication from the nonprofit Center for Internet Security (CIS) with practical guidance for building a security program considered “reasonable” by risk and legal standards. CIS reasonable cybersecurity guide

NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide — A practical risk management and security planning guide tailored for SMBs using the widely accepted NIST Cybersecurity Framework. NIST Small Business QuickStart Guide (SP 1300)
CISA — Secure Your Business (Small & Medium Businesses) — The U.S. Cybersecurity and Infrastructure Security Agency offers simple, achievable cybersecurity steps (like MFA, password basics, and phishing training) for SMBs. CISA Secure Your Business Guidance
“Cybersecurity for SMBs: 10 Best Practices” (WNC Business IT) — A business-oriented list of core actions such as MFA, training, backups, and patching. Cybersecurity for SMBs – 10 Best Practices
“SMB Cybersecurity: Essential Tips for Protecting Your Business” (XL.Net) — Basic guidance on strong passwords, MFA, and software updates. Essential SMB Cybersecurity Practices
Best Practices for Password Security (University of Wisconsin) — covers strong, unique passwords, password managers, multi-factor authentication (MFA), compromised password checks, and safe storage practices. Best Practices for Password Security (UW Security)
Password Security Best Practices for 2025 — highlights unique passwords, changing default credentials, secure sharing, and stronger MFA options (including passkeys). Password Security Best Practices for 2025

Combat AI Challenges with Passpack

For its 2025 Business Impact Report the Identity Theft Resource Center (ITRC) surveyed 662 owners and senior executives at businesses with 500 or fewer employees about their IT security posture and how they plan to combat ai challenges. The study found that only 38% of small business leaders felt their organizations were “very prepared” to fend off a cyberattack or recover from a data breach.₁

The Infostealer Leak Crisis: How Stolen Passwords Are Fueling the Next Wave of Breaches

Infostealer malware has rapidly emerged as one of the most dangerous and least understood cybersecurity threats facing businesses today. Unlike traditional data breaches that target a single organization, infostealer malware quietly harvests passwords, financial data, and sensitive credentials directly from large populations of infected devices, compiling them into massive credential leaks that fuel ransomware, fraud, and identity-based attacks at scale.

How Strong Password Management Could Have Helped Stop the Ubisoft Rainbow Six Siege Password & Token Leak

The recent Ubisoft Rainbow Six Siege incident demonstrates how a massive password leak can disrupt internal IT infrastructure. Rather than targeting user credentials, hackers exploited a database weakness, proving that strong credential management must extend beyond human accounts.

UK’s Most Leaked Passwords in 2026: If You’re Using These, Change Them Now

A comprehensive analysis of the most leaked passwords reveals that British users are making themselves sitting ducks for cybercriminals—and it’s time for a wake-up call.

Tackling the Financial Cost of Cybercrime

In 2025, 62.5% of U.S. small businesses suffered a breach resulting in a combined negative financial impact of at least $250,000 in lost revenue, remediation costs and fines. More than a third of that group reported losses upwards of $500,0001.

Major Current Password Breach Trends: What Security Teams Need to Know Going Into 2026

Unmanaged password breaches remain one of the most common and damaging cyber incidents in today’s digital landscape. Attackers continue to exploit weak credentials, reused passwords and stolen authentication tokens to gain access at scale. Thanks to AI, the growing sophistication of scams and malware make it harder to tell fact from fiction.

Cybersecurity Resources

Helpful Resources

Further Insights Into The Issues: