“Every organization should train their employees on security awareness,” Steve Morgan, founder and editor-in-chief at Cybersecurity Ventures. “And every organization should have a simulated phishing program. This is the process of simulating phishing attacks on employees, regularly, to confirm that the employees are able to recognize the threats and respond to them properly.” Some of the other steps he recommends:

• Ongoing education. Morgan urges business owners to recognize that training is not a one-shot deal. “We’re talking about behavioral training, and that is not something that changes after one class or watching one video.” To optimize cyber safety, your small business needs to reinforce those lessons and update them to integrate the latest scams.
• Develop and maintain good data storage and backup practices. Without them, the time and financial costs of data restoration are compounded and may pose secondary threats to your business by delaying your resumption of normal operations.
• Create a “cyber resiliency.” The last thing you want in the aftermath of a breach is to trust in your ability to improvise productively. As with the simulated phishing scenarios, he urges companies to run breach fire drills “to practice incident and breach response. The steps are going to be different for each organization depending on variables.”

Finally, among the simplest forms of protection is being password-protection savvy. Your anniversary. Your dog’s name. The title of your favorite movie. What do they have in common? When used as passwords, they’re as good as invitations to get hacked. Of course, the more passwords you need, and the more complicated they are, the more likely you are to forget them. That’s where password managers  come in. They allow you to create passwords that are complex enough to foil hackers but give you access to a (password-protected, of course) list so you don’t have to remember them.

Read the Keeping Data Covered: Creating a "Breach-free" Climate guide to learn more about proactive breach prevention.