Smaller organizations process similar amounts of sensitive data as larger ones, and they also face the same legal consequences. The difference is not in the level of the threat, but rather in the resources available to address the threat. Corporate data protection at the enterprise level is predominantly not a question of spending; it is a question of how you do business. Organizations that do data protection properly appear to be characterized by their adherence to certain principles, rather than by the size of their software budget.
You’re Already A Target
Many people tend to believe that attackers are more likely to target larger organizations. However, if we look at the data, this is not the case. Based on the information provided in the Verizon 2023 Data Breach Investigations Report, smaller organizations with less than 1,000 employees are just as likely to be targeted as large enterprises. In both cases, breaches usually occur as a result of a system intrusion, social engineering, or basic web application attack.
Small organizations are appealing targets for cybercriminals because, despite their size, they often possess substantial amounts of valuable personally identifiable information (PII) such as names, email addresses, payment information, and health records. Additionally, their security defenses are usually not as strong as those of their larger enterprise customers or suppliers.
Map Your Data Before You Do Anything Else
You cannot protect what you are not aware you have. Data mapping is that first simple step and does not require any special tooling to get underway.
Walk through each system, application, and process that interacts with personal data. Where does it come in? Where does it live? Who has access to it, and are those accesses periodically reviewed? Who are the vendors that receive it downstream?
This will generally make apparent two things: data you didn’t know you had, and that you are keeping the data longer than you ought to. Both represent unnecessary risk. Aggressive data minimization – that is, only collecting and keeping what is truly needed for business, and getting rid of everything else – will reduce your attack surface a lot more quickly than most technical controls. If the data is not there, it cannot be breached.
Don’t Build Your Compliance Program Alone
One of the most expensive mistakes smaller firms can make is assuming that privacy compliance is something that can be managed in-house with current employees. Privacy regulations – whether GDPR, CCPA/CPRA, or industry-specific standards – have real teeth, and the obligations around items like Subject Access Requests, breach notification timeframes, and data processing records are prescriptive enough that a level of real expertise is required.
But most organizations at this size can’t afford to hire a full-time privacy executive with that expertise. That’s where the concept of an outsourced data protection officer really makes sense – it gives you access to qualified, dedicated privacy expertise at a cost that’s a fraction of a full-time hire, with the added bonus of being able to easily scale your level of engagement up or down as needed.
This isn’t a loophole. This is a real structure that many firms adopt to make sure they’ve got one person who they can hold responsible for helping them meet their regulatory requirements without needing to fully burden the costs of an executive-level salary.
Apply Zero-Trust Principles With The Tools You Already Have
Zero-trust architecture may seem costly, but the basic principles can be implemented through tools that most small businesses already have access to.
First, implement Multi-Factor Authentication for all systems containing sensitive data. For smaller organizations, MFA is the most effective control to block credential-stuffing and phishing attacks, which are the main causes of successful breaches. If your employees are not already using MFA when accessing cloud platforms, this should be the first step.
In addition to MFA, enhance your identity and access management by applying the least privilege concept. Users should only have access to the data and systems that are required for their role. Regularly review these permissions – although access may have been granted for a good reason when someone was first hired, it’s rarely taken away as their role changes. Most cloud platforms and SaaS tools come with role-based access controls that are often unused. So, make the most of them.
Also, enable encryption both at rest and in transit. This is usually set up by default in most modern platforms, but it’s a good practice to double-check. Encryption won’t stop a breach, but it reduces the impacts of one.
Have A Breach Response Plan Before You Need One
Many smaller entities do not possess an Incident Response Plan. When an intrusion happens, the organizational chaos around identifying responsibilities, necessary notifications, and response times imposes heavy additional costs.
An efficient IRP is not necessarily a 50-page tome. It should state who is in command of detecting and limiting the attack, who green-lights going public, which legal requirements for notifications kick in, and from whom, and which service providers and legal advisers to summon. Once per year, you should test the plan. This can be done in a few hours during a “table-top” simulation with involved stakeholders. It will uncover weaknesses that stay hidden even after lots of policy writing.
Vet Your Vendors With The Same Seriousness As Your Internal Systems
Third-party risk is a big blind spot in many small orgs’ data protection programs. Every SaaS tool, cloud platform, and external vendor that touches your data is part of your risk footprint.
There are standard vendor assessment questionnaires that are designed for exactly this kind of situation (the SIG or CAIQ, for example). Decide that if you’re bringing on a new vendor who will process PII, you’ll have them fill one out. Read their answers. Where you care, ask for proof. It doesn’t need to be an all-consuming level of due diligence, but you must put in the effort.
Enterprise-level data protection isn’t about having an enterprise budget. It’s about making those kinds of decisions on purpose – about what data you have, who can get to it, how you’ll react when the worst happens, and who’s responsible for making sure the whole thing runs smoothly.
