Free · For Small Businesses

Small Business Security Starter Kit

Practical security help for small businesses — no budget and no security team required.

You don't need to be technical, and you don't need to do everything at once. Start with step one. Each piece here is free, vendor-neutral, and takes minutes, not days.

Start here

1. Lock down the AI tools you already use

If you — or anyone on your team — uses ChatGPT, Gemini, Copilot, or Claude, a few settings make a real difference. This guide is the short list that matters — and why — in about ten minutes.

Read the AI settings guide →

2. Ask your IT or security provider the right questions · if you outsource

Outsource your IT or security to an MSP/MSSP? They're almost certainly using AI on your behalf. Here are the plain-language questions to ask — and the green and red flags to listen for.

Read the provider checklist →

3. See where you actually stand

BeaconScore, our free self-assessment, walks you through a few questions and gives you a clear posture grade — and shows what to fix first. Like a beacon, it shows you the way. Nothing you enter leaves your browser.

Open BeaconScore →

Run a water or electric utility?

Get the utility edition · free field guide

The Small Utility Cyber Defense Kit is this starter kit's big sibling for small water and electric utilities: three actions this week, resilience this quarter, and a build-it-yourself network sensor — all from free programs and open-source tools. Print it, hand it to your GM, or bring it to your next board meeting.

Open the Utility Kit →
One rule worth more than any setting: never paste secrets, customer data, or anything regulated into a free or consumer AI tool. No toggle makes that safe.

More to come. This kit is growing — additional free guides and tools for small businesses are on the way. Everything here is published by the Value Chain Risk Institute, a non-profit, under Creative Commons BY 4.0 — free to use, share, and reprint with credit. Bookmark this page (valuechainrisk.org/starter) or share it with a business that could use it.