A free-first security stack for a one-person business

Security starts with repeatable behavior.

CISA, NIST, and the FTC repeatedly converge on the same fundamentals: use strong unique passwords, enable multifactor authentication, update software, back up important data, and prepare for phishing.

Those controls are not glamorous, but they address the paths attackers use most often. A paid product cannot repair password reuse, an unprotected email account, or a backup that has never been tested.

One unique password per account, generated and stored.

NIST tells small businesses to require strong passwords and consider a password manager. CISA describes a company-wide password manager as a practical way to generate, store, and fill complex passwords. The point is to stop remembering patterns and stop reusing credentials.

A practical free starting point

Proton Pass Free currently includes unlimited entries and devices, a password generator, alerts for weak or reused passwords, ten hide-my-email aliases, and limited 2FA storage. That is enough for a solo operator to replace reused passwords without a monthly bill.

Turn on the strongest MFA available

Enable MFA everywhere it is offered, especially on administrator and recovery accounts. When a service supports phishing-resistant options such as a security key, they are stronger than SMS codes. Store recovery codes offline in a place you can reach if the phone is lost.

Let updates happen before an attacker chooses the schedule.

Turn on automatic updates for operating systems, browsers, phones, routers, and business apps. Remove software and browser extensions you no longer use; each one expands the attack surface and creates another place that needs updates.

• Lock every device with a strong PIN, password, or supported biometric control.
• Use device encryption and verify it is enabled before storing customer or business records.
• Use a separate daily account when practical instead of working as an administrator.
• Limit browser extensions to tools you trust and still need.

A backup is only real after a restore works.

The FTC recommends regular backups to cloud storage or an external drive. NIST adds an important word: test them. Keep critical records in more than one place, protect the backup account with MFA, and periodically restore a sample file.

A VPN can protect a connection; it cannot fix bad security.

A reputable VPN can be useful when you regularly work on untrusted networks or need secure remote access. It does not stop phishing, make weak passwords safe, or turn an infected device into a trusted one.

Proton and NordVPN both sell subscription services and publish recurring affiliate programs. That commercial fact is exactly why this guide ranks the underlying controls before a VPN purchase. Buy a VPN for a defined network or privacy requirement—not because a countdown timer created urgency.

Do these in order.

1. 01

   Secure the primary email.Unique password, strong MFA, current recovery details, saved offline recovery codes.

2. 02

   Move credentials into a password manager.Start with finance, domain, cloud storage, and social accounts.

3. 03

   Turn on automatic updates.Check the phone, computer, browser, and router.

4. 04

   Verify the backup.Restore one important file and confirm you can access it without the primary device.

5. 05

   Delete data you do not need.Less retained information means less information available to lose.