Small & Medium Business

List business email, banking, payroll, accounting, cloud storage, website administration, and other essential services. Record the owner, administrator, recovery method, and provider contact for each. Use separate accounts for each person and strong authentication wherever supported.

The Infosec Lead can help organize priorities in plain language, while Librarian can support an inventory of systems and ownership. Review access when employees leave or a bookkeeper, contractor, or managed-service provider changes. Avoid letting the only recovery method depend on one person's private phone or mailbox.

• Protect the domain registrar and primary email administrator.
• Use a password manager and remove reused or shared passwords.

Establish a simple rule for requests involving changed bank details, urgent transfers, payroll changes, or unusual purchases: verify independently before paying. Use a trusted number already held in business records. A familiar invoice format or email conversation does not establish that a change is genuine.

Plutus and Psycher can support payment and suspicious-message review, but an authorized person must still approve consequential actions. Give staff permission to pause a transaction and a clear person to call. Apply the same process when the request appears to come from the owner.

• Separate supplier-bank changes from routine invoice approval.
• Keep a short record of verification and approval.

Identify what the business needs to operate if email, accounting, or a major supplier is unavailable. Keep protected backups and test restoration of representative files and records. Write a short incident contact sheet covering IT support, the bank, key providers, and appropriate reporting channels.

Horsemen can support managed-device work within agreed coverage, and Dewey can assist with recovery coordination. Human owners must approve account restrictions, device changes, and external communications. Ask service providers what they actually manage and what remains your responsibility, then document gaps rather than assuming they are covered.

• Enable supported updates and retire unsupported systems.
• Practice one account-compromise or payment-fraud scenario with staff.