Go Back Up

triangle-exclamation-sharp-solid-full Security incident? Get immediate help

Minimum Security Standards: The Baseline Growing Businesses Need

Published: Updated: Paul Breitenbach 10 min read

Minimum Security Standards: The Baseline Growing Businesses Need
7:36

IBM’s 2026 Cost of a Data Breach Report found that a breach now costs a U.S. organization an average of $11.5 million, more than double the global average of $4.99 million. Both figures are record highs.

Attackers target far more than big names. The 2026 Verizon Data Breach Investigations Report found that small organizations made up 96% of ransomware victims. Most attacks are opportunistic, so attackers look for a stolen password or an unpatched device wherever they can find one, regardless of industry or revenue size.

That is why minimum security standards (MSS) matter. They are the short list of controls every business should have in place, no matter its size. They are also what cyber insurers, regulators and business partners now expect to see proof of before they work with you.

If you haven't assessed your security baseline in the last year, here are seven risks you're carrying, and what a modern baseline looks like.

Copa breach now costs a U.S. organization an average of $11.5 milliony of Stats - Blog (33)

In this Article



7 risks of operating without minimum security standards 

1. Data breaches

Weak security controls give unauthorized people a path to customer records, financial data, employee details and intellectual property. That path is usually a basic gap. The 2026 Verizon Data Breach Investigations Report found that exploited software vulnerabilities have overtaken stolen credentials as the top way attackers get in. IBM’s 2026 Cost of a Data Breach Report found that 53% of breached organizations had not encrypted their sensitive data.

2. Financial loss

A breach brings investigation costs, system restoration, customer notification, credit monitoring, legal fees, regulatory fines and lawsuits. IBM’s 2026 Cost of a Data Breach Report found that the average U.S. breach now costs $11.5 million, which is more than most businesses can absorb from operating cash. The same report shows that speed matters, because breaches contained in under 200 days cost about $1.3 million less than those that ran longer.

3. Legal and regulatory consequences

Roughly 20 states now have comprehensive consumer privacy laws in effect, with Indiana, Kentucky and Rhode Island added in January 2026. You inherit the rules of every state your customers live in, on top of industry rules like HIPAA, PCI DSS and the FTC Safeguards Rule. Non-compliance can mean fines, penalties and, in regulated industries, suspended operations.

4. Damage to reputation

Attackers now use your reputation as leverage. In IBM's 2026 data, 41% of ransomware attacks targeted brand reputation through public shaming and media leaks. Lost customer trust often outlasts the technical recovery.

5. Intellectual property theft

Trade secrets, proprietary processes, R&D data and product designs are prime targets, and losing them can erase a competitive edge. A newer leak path is AI: 67% of employees using AI at work do so through personal, non-corporate accounts. Incidents tied to unapproved "shadow AI" rose to 43% of organizations studied by IBM, up from 20% a year earlier.

67% 0f employees using AI at work use a personal account

6. Operational disruption

Ransomware appeared in nearly half of all breaches in the 2026 DBIR. When systems are encrypted, you can't serve customers, ship orders or run payroll. Organizations with reliable, tested backups recover without paying: 69% of small and midsize victims refused the ransom because their backups held.

7. Supply chain risk

Third-party involvement now appears in 48% of breaches, up from 30% the year before. Risk runs both ways: a vendor's weak security can expose you, and a compromise in your environment can become an attacker's path into your clients' and partners' networks. More customers now ask suppliers to prove their security before signing or renewing contracts.

What minimum security standards look like today

The baseline has largely been set for you by cyber insurers. Most carriers now treat MFA, endpoint detection and response (EDR) and tested backups as hard requirements, and missing any one can mean no quote at all. They also increasingly ask for proof, such as coverage reports and dated restore tests, rather than a yes on a questionnaire.

Here are the ten controls we consider the minimum for any business:

Control

What it means in practice

Why it's on the list

Multi-factor authentication (MFA)

On email, remote access, cloud apps and every admin account, with 100% enrollment

Stops most attacks that use stolen passwords; required by nearly every insurer

Endpoint detection and response (EDR)

On every laptop, desktop and server, monitored around the clock

Traditional antivirus misses modern ransomware; insurers now expect EDR or MDR

Immutable, tested backups

Follow the 3-2-1 rule, keep one copy that can't be altered, and test restores on a schedule

Ransomware targets backups first; untested backups often fail when needed

Patch and vulnerability management

Patch internet-facing systems fast and retire unsupported software

Exploited vulnerabilities are now the top way attackers get in

Email security

SPF, DKIM and DMARC set to enforce, plus filtering for phishing

Blocks spoofing and business email compromise

Least-privilege access

Separate admin accounts, regular access reviews, prompt offboarding

Limits how far an attacker can move with one compromised account

Security awareness training

Onboarding plus ongoing training, including text and phone scams

People are involved in most breaches; SMS and voice phishing now outperform email

Incident response plan

A written plan, tested in a tabletop exercise at least once a year

Faster containment directly lowers breach costs

Encryption

Sensitive data encrypted at rest and in transit, including on laptops

Over half of breached organizations had not encrypted sensitive data

Vendor and AI governance

Review vendor security, limit their access, and approve which AI tools staff may use

Third parties and unapproved AI are two of the fastest-growing leak paths

If you already follow a framework such as the NIST Cybersecurity Framework 2.0 or CIS Controls, these items map to its core safeguards. If you don't, this list is a practical place to start.

How to get started

An assessment shows you exactly where you stand before an attacker, an insurer or a client finds the gaps for you. A practical first pass takes four steps:

  1. Inventory what you have. List your devices, software, cloud apps, user accounts and the vendors with access to your systems.
  2. Measure each control, not just whether it exists. "We have MFA" isn't enough; know what percentage of accounts are enrolled and whether EDR covers every server.
  3. Prove your backups work. Run a restore test and record the date.
  4. Prioritize the gaps. Fix the items that block insurance coverage or expose customer data first, then build a roadmap for the rest.

Compass can run this assessment with you and show you where your business meets minimum security standards and where it falls short. Start with our Cybersecurity Assessment Guide, or contact your account manager or email contactus@compassmsp.com to get started.

 

YOU MAY NEED TO KNOW

Frequently Asked Questions

What are minimum security standards?

Minimum security standards are the baseline controls every business should have in place to protect its systems and data. They typically include multi-factor authentication, endpoint detection and response, tested backups, timely patching, email security, employee training and an incident response plan. These standards set the floor for your security program, and more advanced protections build on top of them.

Do minimum security standards apply to small and growing businesses?

Yes, and smaller businesses are often the most exposed. The 2026 Verizon Data Breach Investigations Report found that small organizations made up 96% of ransomware victims. Attackers look for easy entry points, and growing businesses frequently add users, devices and vendors faster than they add security controls.

How much does a data breach cost?

IBM's 2026 Cost of a Data Breach Report found that the average U.S. breach costs $11.5 million, compared with a global average of $4.99 million. Costs include investigation, recovery, customer notification, legal fees, fines and lost business. Smaller organizations may see lower totals, but those costs can still exceed what the business can absorb.

What security controls do cyber insurers require?

Most cyber insurers now require multi-factor authentication, endpoint detection and response, and backups that are protected from tampering and tested regularly. Many also ask about email security, patching, privileged access, employee training and incident response planning. Insurers increasingly ask for proof, such as coverage reports and dated restore tests, so a yes on the application is no longer enough.

Learn more about cyber insurance for small and mid-sized businesses in this beginner's guide. 

What is the difference between antivirus and EDR?

Traditional antivirus blocks known malicious files based on signatures. Endpoint detection and response (EDR) monitors device behavior continuously, so it can spot and stop attacks that use new or disguised techniques. EDR is most effective when security analysts monitor its alerts around the clock and respond quickly.

Why are regular backups not enough on their own?

Ransomware is designed to find and encrypt or delete backups before it locks your systems. Backups need at least one copy that can't be altered, and you need to test restores to confirm they work. The 2026 Verizon Data Breach Investigations Report found that 69% of small and midsize ransomware victims refused to pay because they had reliable backups.

How do vendors and suppliers affect our security?

Vendors with access to your systems or data extend your attack surface. The 2026 Verizon Data Breach Investigations Report found that third parties were involved in 48% of breaches, up from 30% the year before. Review each vendor's security practices, limit their access to what they need, and revisit those reviews regularly.

Do we need a policy for employee use of AI tools?

Yes. The 2026 Verizon Data Breach Investigations Report found that 67% of employees who use AI at work do so through personal accounts, which can expose customer data and intellectual property. An AI policy should name approved tools, define what data staff may enter, and explain the risks of unapproved services.

How often should we assess our security?

Assess your security at least once a year. You should also reassess after major changes, such as an acquisition, a move to new cloud systems or rapid hiring, and before each cyber insurance renewal. Regular assessments catch gaps before an attacker, auditor or insurer does.

Which security framework should we follow?

The NIST Cybersecurity Framework 2.0 and the CIS Critical Security Controls are two of the most widely used options for growing businesses. Both organize security into practical safeguards and map well to insurance and compliance requirements. If your industry has its own rules, such as HIPAA, PCI DSS or CMMC, your framework should cover those requirements too.

Paul Breitenbach

With nearly 20 years of experience designing enterprise-grade IT solutions, Paul specializes in supporting organizations that cannot afford downtime. Before becoming our CIO, he served as CIO of WorldwideIT, a Compass company, where he led large-scale infrastructure, cloud, and security initiatives for highly regulated industries.

Navigate What’s Next

Get new insights, practical guides, and timely resources delivered to your inbox.