Run a real security programme in a small company, with no security team
A complete, plain-words toolkit for the person who owns security alongside a day job: the method, the registers, the policies, the incident plan, the exact words and a 90-day roadmap, structured on the six NIST CSF 2.0 functions.
- A 10-chapter e-book that builds the programme in 90 days, following one composite 60-person firm from a customer questionnaire to a handled phishing incident
- The Security Programme Workbook: 15 sheets covering assets, risks, 30 controls, access, patches, backups, vendors, training, phishing simulations, incidents, KPIs, a questionnaire answer bank and a live dashboard
- 12 one-page security policies, an incident response plan with 5 playbooks, a training outline with 12 monthly micro-topics, 38 messages and scripts and 29 AI prompts
- 5 fillable PDF forms, a risk scorer and budget planner, 3 cheat sheets including dated standards and law notes, a 52-event calendar and a 40-task import file
Information Security for Small Business · Bodhih Pro Kits · 190 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do I set up information security in a small business without a security team?
Name one owner, list your devices, accounts, apps, data and suppliers, score the main risks, then put twelve baseline controls in place and verify each one. Add short policies, fair training, an incident plan with playbooks and a monthly measure. The Information Security for Small Business Kit from Bodhih Training gives you a file for every step.
Want the full free guide first? Read How to Build an Information Security Programme for a Small Business.
You already feel the problem. Here is what it is costing you.
Nobody owns it
The IT partner assumes you decide; you assume the IT partner has it covered. Updates lapse, leavers keep access and backups stop quietly, and nobody notices until something breaks.
The questionnaire you cannot answer
A customer sends 60 security questions with a ten-day deadline. Is MFA enforced for everyone? When was the last tested restore? Who is responsible for security? The honest answer to several is 'not sure'.
Too small to be a target
Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of the breaches it studied at small and medium businesses. Attackers send messages in bulk and see who clicks; size is no protection.
Switched on is not the same as done
MFA is available but not enforced. The laptops are probably encrypted. The backup dashboard is green, but nobody has restored anything. Without evidence, you cannot tell leadership, a customer or an insurer where you stand.
No plan for the bad morning
When a partner's mailbox is taken over and clients receive fake bank details, the first hour decides the cost. Without a plan, people change a password, wait and hope.
AI tools arriving faster than rules
Staff paste client documents into whatever assistant is open, and nobody has said which tools are approved. Meanwhile attackers use the same tools to write better lures.
Picture the next few weeks with the kit open beside you.
Picture the first Monday. You open the Start Here map, type your company, your name as owner and your targets into the Settings sheet, and fill in the self-assessment in pencil. Twenty minutes later you have a baseline score, and you know which of the six functions needs you first.
Now it is week three. As you work through the Assets sheet with your IT partner, the gaps count themselves: the old file server, the tool marketing signed up for with a personal card, the agency login still active. The risk workshop takes ninety minutes, and leadership agrees the top three because the Risk Scorer has put an expected annual loss next to each one.
Imagine the Friday morning when a client phones to ask whether your bank details have really changed. You take the first-hour card from the cupboard door, disable the account, revoke the sessions and call the three clients with the script in front of you. By lunchtime the incident form is filled in, no money has moved, and the review is booked.
And then the next customer questionnaire arrives. You open the Questionnaire Answers sheet, match the questions, write the four new answers with the Controls sheet open and send it the same afternoon. Whether you start with the self-assessment tonight or the Settings sheet tomorrow morning, the programme starts with your name as owner.
20 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
Information Security for Small Business (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: security programme map
The whole job as six functions with the file to open at each, your first hour, a 30/60/90 day use plan and links to measure your starting point.
Security Programme Workbook
15-sheet workbook: settings, asset inventory, risk register, 30-control checklist mapped to NIST CSF 2.0 functions, access log with days-to-revoke, patch tracker, backup and restore tests, vendor register, training, phishing simulations, incident log, monthly KPIs, a customer questionnaire answer bank and a dashboard.
Security Risk Scorer and Budget Planner
Five-sheet calculator: puts money on ten security scenarios (expected annual loss before and after a control, return per unit spent) and plans a year's security spend by category, priority and phase against a budget cap.
Security self-assessment
Thirty evidence-based statements across Govern, Identify, Protect, Detect, Respond and Recover, with per-function scores and a priority table. Your day-1 and day-90 baseline.
Risk assessment sheet
Two-page sheet for one risk: scenario, asset, data, likelihood and impact scoring guides, treatment choice, controls table, residual score, owner and early warning signs.
Access review and account set-up form
Four pages: a quarterly access review by person and system, a joiner set-up checklist, a leaver access removal checklist with a same-day target and sign-off, and the new device and account set-up checklist so every device leaves IT in the same known-good state.
Incident report and triage form
Four pages: the first report anyone can fill in, a triage page with a severity guide and the first-hour actions, a timeline and decisions log, and the closure and lessons page.
Vendor security questionnaire
23 questions in five sections (governance, access, data protection, operations, incidents and people) with evidence columns, a criticality rating and a decision page. Send to any supplier that holds your data.
Information security policy set
12 concise policies people will actually read: information security, acceptable use, access control, password and MFA, device, remote and personal device, backup, incident reporting, vendor and cloud, data handling, AI use and training, with an acknowledgement page.
Incident response plan and playbooks
A plan a non-specialist can run: roles, a printable contact list, severity levels, the first hour, notification decisions, 5 playbooks (phishing and BEC, ransomware, lost device, compromised account, data leak), a review template and a tabletop exercise.
Security awareness training outline
A 45-minute launch session, a 20-minute onboarding module, three role modules, 12 monthly micro-topics (key message, talking points, activity, quiz question) and a fair phishing simulation plan with measures.
Security message and script library
38 messages and spoken scripts: programme launch, MFA and password manager rollouts, fair phishing simulation debriefs, incident notices to staff and customers, payment verification calls, insurer and IT escalation, vendor requests and leadership updates.
Worked example pack: Northgate Advisory's 90 days and one phishing incident
One composite case shown completely: a 60-person accounting and advisory firm's 90-day security programme (self-assessment, risks, controls, budget, KPIs) and a business email compromise handled hour by hour with the incident form filled in.
AI prompt pack for security programmes
29 tool-agnostic prompts grouped by the six functions of the programme, each with what to paste in and what to check before you use the output.
Baseline controls and decision card
Twelve baseline controls in order with why, done-when and where to track each, the joiner, mover, leaver rule, sixteen if-this-then-that decisions and twelve mistakes to avoid, with the evidence behind the advice.
Incident first-hour card
Minute-by-minute first hour for any incident, the severity table, which playbook to open, and five things not to do. Print it and keep it off-system.
Security standards and law notes (October 2026)
Dated quick reference: NIST CSF 2.0, ISO 27001, Cyber Essentials, CIS Controls, SOC 2 in one line each; breach notification regimes for the EU, UK, India, US, Singapore, Nigeria, Australia and more; EU AI Act dates; insurer expectations.
90-day security roadmap calendar
52 calendar events over 90 days, from the day-1 self-assessment to the day-90 review, each naming the file to open. Import into a new calendar and shift to your start date.
Security roadmap task board import
40 roadmap tasks as a CSV ready to import into Trello, Asana, Notion, Planner or Jira, with function, week, owner, file to open and due date.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 20 files plus a one-click ZIP
- E-book
- 60 pages
- Workbooks
- 15-sheet programme workbook and 5-sheet risk scorer and budget planner, with sample data, formulas and dashboards
- Works with
- Excel, Google Sheets, LibreOffice, Word, Google Docs, Acrobat Reader, GoodNotes, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira
- Best for
- Companies of roughly 10 to 500 people without a dedicated security team, in any country and currency
Security Without a Security Team
What the kit builds, what it is not, and the six-function method on one page.
Who Attacks Small Companies, and How
The verified numbers, the four-link attack chain and the six threats every small company should plan for.
Own It: Roles, Policies and the Risk Conversation
Four decisions in one leadership meeting, policies people read, and a monthly, quarterly and yearly rhythm.
Know What You Have: Assets, Data and Vendors
An inventory of devices, accounts, SaaS, data and suppliers that turns 'I think we're fine' into a count of gaps.
Score It: Risk Assessment and Putting Money on Risk
Likelihood times impact with a shared guide, four treatments, and expected annual loss for the budget conversation.
The Baseline Controls That Stop Most Attacks
Twelve controls, from enforced MFA to the payment call-back rule, with what 'done' looks like for each.
People and Access: Joiners, Leavers, Devices and Remote Work
Joiner, mover, leaver and quarterly reviews, days to revoke, personal devices and remote work.
Vendors, Questionnaires and Certifications
Assessing suppliers, building a customer answer bank, and Cyber Essentials, ISO 27001 and SOC 2 in plain words.
Training and Phishing Simulations Done Fairly
Short, frequent training and simulations that celebrate reports and never name the people who click.
When It Goes Wrong: Incident Response and Recovery
The same first hour for every incident, five playbooks, notification clocks, recovery order and a blameless review.
AI, Measurement, Budget and the Next 90 Days
Three rules for AI, seven monthly measures, spending in the right order and planning the next cycle.
The Programme You Now Own
What to keep doing monthly, quarterly and yearly once the first 90 days are over.
Security KPI Definitions
Plain definitions for twelve measures, matched to the workbook.
Jargon Decoder
What vendors, insurers and customers mean by MFA, EDR, DMARC, RTO, SOC 2 and more.
Not just reading. Tools you will actually open again.
E-book
- Information Security for Small Business: 10 chapters, 2 appendices and 6 hand-drawn figures (PDF)
Start here
- 00-Start-Here-Security-Programme-Map: the job as six functions with the file to open at each, your first hour and a 30/60/90 day use plan
Spreadsheets
- Security Programme Workbook (15 sheets): Start here, Settings, Assets, Risk Register, Controls (30 controls mapped to the six functions), Access Review with days to revoke, Patch Tracker, Backup Tests, Vendors, Training, Phishing Sims, Incidents, KPI Tracker, Questionnaire Answers (24 sample answers) and a Dashboard with 25 live measures and a chart
- Security Risk Scorer and Budget Planner (5 sheets): expected annual loss before and after a control for ten scenarios, and a year's spend by tool category against your budget cap
Fillable PDF forms
- Security self-assessment: 30 evidence-based statements across the six functions, your day-1 and day-90 score
- Risk assessment sheet: scenario, scoring guides, treatment, controls, residual score and owner
- Access review and account set-up form: quarterly review, joiner checklist, leaver checklist and new device and account set-up checklist
- Incident report and triage form: first report, triage and first hour, timeline and decisions, closure and lessons
- Vendor security questionnaire: 23 questions in five sections with evidence columns and a decision page
Word templates
- Information security policy set: 12 one-page policies, including AI use, with an acknowledgement page
- Incident response plan and playbooks: roles, contact list, severity levels, the first hour, notification decisions, 5 playbooks, a review template and a tabletop exercise
- Security awareness training outline: launch session, onboarding module, three role modules, 12 monthly micro-topics and a fair phishing simulation plan
- Security message and script library: 38 messages and spoken scripts from programme launch to incident notices, vendor requests and leadership updates
- Worked example pack: one composite 60-person firm's 90-day programme and one phishing incident handled hour by hour
- AI prompt pack for security programmes: 29 prompts, each with what to paste in and what to check
Cheat sheets
- Baseline controls and decision card: twelve controls, the joiner, mover, leaver rule, sixteen if-this-then-that decisions and twelve mistakes to avoid
- Incident first-hour card: minute by minute, the severity table, which playbook to open and five things not to do
- Security standards and law notes, dated October 2026: frameworks, breach notification regimes by country, AI rules and insurer expectations
Calendar and import
- 90-day security roadmap calendar (ICS): 52 events for Google Calendar, Outlook or Apple Calendar
- Security roadmap task board (CSV): 40 tasks for Trello, Asana, Notion, Planner or Jira
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Name an owner, agree a 90-day plan, a risk appetite and a budget cap in one leadership meeting
- Build an inventory of devices, accounts, SaaS, data and suppliers with owners and control status
- Score and rank security risks, and show leadership the expected annual loss behind each one
- Put twelve baseline controls in place and record the evidence that each one works
- Run joiner, mover and leaver changes and quarterly access reviews, and track days to revoke
- Assess vendors and answer customer security questionnaires from an approved answer bank
- Train staff and run phishing simulations that raise the report rate without shaming anyone
- Handle the first hour of an incident with a plan, a playbook and a form, and report seven measures monthly
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff
Take the assessment →AssessAll assessmentSocial Engineering & Phishing Defence Judgment
Take the assessment →AssessAll assessmentIncident Response & On-Call Judgment
Take the assessment →JobularyHow a Jobulary development plan works
Make it a growth plan →A taste of Chapter 4
Without scoring, security spend follows whoever shouted last. A partner reads about ransomware and wants a tool; the IT provider wants to sell a firewall; nobody mentions that the finance team pays supplier invoices on the strength of an email. Scoring forces every scenario through the same two questions: how likely is it, and how bad would it be? The product is a number you can rank, and ranking is what a small company needs, because it cannot do everything at once. The old idea behind the impact question is the CIA triad from decades of security practice: confidentiality (the wrong people see it), integrity (it is changed without you knowing) and availability (you cannot use it). Ransomware is an availability attack with a confidentiality threat attached. Invoice fraud is an integrity attack on your payment process. Keep the three in mind when you ask "how bad?"
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Starting point | A list of tools to buy | A named owner, a self-assessment baseline and four leadership decisions |
| Policies | Forty pages nobody reads | 12 one-page policies with an acknowledgement record |
| Controls | Switched on and assumed | 30 controls with status, evidence and a last-verified date |
| Risk | Whoever shouted last | Scored, ranked and priced as expected annual loss |
| Phishing | Trap simulations and naming clickers | Announced simulations, team-level results, kind private debriefs and report rate as the measure |
| Incidents | An IT phone number on a sticky note | A first-hour card, 5 playbooks, an incident form and a tabletop exercise |
| Customers and law | One country assumed, no dates | A questionnaire answer bank and standards and law notes dated October 2026 for many countries |
Made for you if…
- Operations directors, office managers and founders who own security alongside everything else
- IT managers in small and mid-size companies who need a programme, not just tools
- Compliance officers, data protection leads and risk owners who must show security is managed
- HR and office managers who own the policies, the joiner and leaver process and staff training
- Companies answering customer security questionnaires or considering Cyber Essentials, ISO 27001 or SOC 2
- Teams in India, the UK, the US, the Gulf, Singapore, the Philippines, Africa and Australia, in any currency
Probably not for you if…
- Anyone looking for a legal opinion, an audit or a certification: the kit helps you organise a programme and points you to your regulator, counsel and local law
- Security teams in large enterprises with a full-time security operations function
- Developers securing software they build (Ship It Safely covers that) or individuals protecting themselves from scams (Scam-Proof Digital Safety covers that)
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
The next questionnaire, or the next bad morning, is coming. Have the programme ready first.
Open the Start Here map, write your name as owner on the Settings sheet and take the self-assessment. Whether you begin with the e-book this evening or the risk workshop next week, the first hour is already planned.
Personal licence for the buyer's own use (and use with your own team or clients where the kit says so). Please don't share or resell the files. Team and company licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The AI Use Policy and Governance Kit
Govern AI at work properly.
The Data Privacy Compliance Starter
Set up a privacy programme for a small or mid-size company.
The Harassment Prevention Programme Kit
Build a respectful workplace programme.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
Information Security for Small Business: FAQs
Read the free guideAlready bought? Resend my linkWhat security controls does a small business need first?
Start with the controls that stop the most common attacks: multi-factor authentication enforced everywhere, a password manager, separate admin accounts, updates on time, endpoint protection, email security with SPF, DKIM and DMARC, encryption, tested backups and a payment call-back rule. Chapter 5 covers twelve controls with what 'done' looks like for each, and the decision card puts them on one page.
Do we need a security team or a consultant to use this kit?
No. The kit is written for the person who owns security alongside another job, working with whoever runs your IT, whether that is an outside provider or one internal person. Your IT partner supplies the technical changes; the kit supplies the programme, the registers and the decisions.
How does the kit relate to NIST CSF, ISO 27001 and Cyber Essentials?
The programme is organised on the six functions of NIST CSF 2.0 and borrows ideas from ISO/IEC 27001:2022, Cyber Essentials and the CIS Controls, described in our own words. It is not a certification and does not reproduce standards text, but its registers are the evidence an assessor will ask for, and Chapter 7 explains when each certification makes sense.
How do I answer a customer security questionnaire?
Build an approved answer bank before the next one arrives, write each answer from what you can evidence, and say 'in progress, by a date' where a control is not yet done. The Questionnaire Answers sheet has 24 sample answers by topic, and the message library includes a cover note and replies for common requests.
What should we do in the first hour of a phishing or ransomware incident?
Log it and call your IT partner, contain it by disabling accounts and revoking sessions or isolating devices, preserve evidence and scope what happened, then decide severity and who to tell, including your insurer and counsel where personal data may be involved. The first-hour card, the incident form and five playbooks walk you through it.
How do I measure my staff's starting point on security awareness?
AssessAll offers assessments that match this kit: the Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff, Social Engineering & Phishing Defence Judgment, and Incident Response & On-Call Judgment. They are separate products, not included in the kit; the links are on the Start Here map.
How can I turn this into a development plan for myself or my team?
Pick the skills the programme needs most, such as risk scoring, incident handling or vendor assessment, and build them into a plan with practice dates from the roadmap. Jobulary explains how its development plans work, and the link is on the Start Here map.
Is this legal advice for my country?
No. The kit is educational: it helps a company organise its security programme and is not a legal opinion, audit or certification. Breach notification and data protection rules differ by country and change often, so the specifics sit in one sheet dated October 2026; check your regulator, counsel and local law before acting.
Which software do I need?
The workbooks open in Excel, Google Sheets or LibreOffice and use no macros. The forms are fillable in Acrobat Reader and most PDF apps, the templates open in Word or Google Docs, the calendar imports into Google Calendar, Outlook or Apple Calendar, and the CSV imports into Trello, Asana, Notion, Planner or Jira. The kit names tool categories, not brands.
What is the refund policy?
Digital kits are non-refundable once downloaded. The exceptions are corrupted files that are not fixed within 3 working days, duplicate charges, or failed delivery.
How much does Information Security for Small Business cost?
₹999 including 18% GST for buyers in India, or $29 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
