IBM’s 2026 Cost of a Data Breach Report found that a breach now costs a U.S. organization an average of $11.5 million, more than double the global average of $4.99 million. Both figures are record highs.
Attackers target far more than big names. The 2026 Verizon Data Breach Investigations Report found that small organizations made up 96% of ransomware victims. Most attacks are opportunistic, so attackers look for a stolen password or an unpatched device wherever they can find one, regardless of industry or revenue size.
That is why minimum security standards (MSS) matter. They are the short list of controls every business should have in place, no matter its size. They are also what cyber insurers, regulators and business partners now expect to see proof of before they work with you.
If you haven't assessed your security baseline in the last year, here are seven risks you're carrying, and what a modern baseline looks like.
In this Article
Weak security controls give unauthorized people a path to customer records, financial data, employee details and intellectual property. That path is usually a basic gap. The 2026 Verizon Data Breach Investigations Report found that exploited software vulnerabilities have overtaken stolen credentials as the top way attackers get in. IBM’s 2026 Cost of a Data Breach Report found that 53% of breached organizations had not encrypted their sensitive data.
A breach brings investigation costs, system restoration, customer notification, credit monitoring, legal fees, regulatory fines and lawsuits. IBM’s 2026 Cost of a Data Breach Report found that the average U.S. breach now costs $11.5 million, which is more than most businesses can absorb from operating cash. The same report shows that speed matters, because breaches contained in under 200 days cost about $1.3 million less than those that ran longer.
Roughly 20 states now have comprehensive consumer privacy laws in effect, with Indiana, Kentucky and Rhode Island added in January 2026. You inherit the rules of every state your customers live in, on top of industry rules like HIPAA, PCI DSS and the FTC Safeguards Rule. Non-compliance can mean fines, penalties and, in regulated industries, suspended operations.
Attackers now use your reputation as leverage. In IBM's 2026 data, 41% of ransomware attacks targeted brand reputation through public shaming and media leaks. Lost customer trust often outlasts the technical recovery.
Trade secrets, proprietary processes, R&D data and product designs are prime targets, and losing them can erase a competitive edge. A newer leak path is AI: 67% of employees using AI at work do so through personal, non-corporate accounts. Incidents tied to unapproved "shadow AI" rose to 43% of organizations studied by IBM, up from 20% a year earlier.
Ransomware appeared in nearly half of all breaches in the 2026 DBIR. When systems are encrypted, you can't serve customers, ship orders or run payroll. Organizations with reliable, tested backups recover without paying: 69% of small and midsize victims refused the ransom because their backups held.
Third-party involvement now appears in 48% of breaches, up from 30% the year before. Risk runs both ways: a vendor's weak security can expose you, and a compromise in your environment can become an attacker's path into your clients' and partners' networks. More customers now ask suppliers to prove their security before signing or renewing contracts.
The baseline has largely been set for you by cyber insurers. Most carriers now treat MFA, endpoint detection and response (EDR) and tested backups as hard requirements, and missing any one can mean no quote at all. They also increasingly ask for proof, such as coverage reports and dated restore tests, rather than a yes on a questionnaire.
Here are the ten controls we consider the minimum for any business:
|
Control |
What it means in practice |
Why it's on the list |
|---|---|---|
|
Multi-factor authentication (MFA) |
On email, remote access, cloud apps and every admin account, with 100% enrollment |
Stops most attacks that use stolen passwords; required by nearly every insurer |
|
Endpoint detection and response (EDR) |
On every laptop, desktop and server, monitored around the clock |
Traditional antivirus misses modern ransomware; insurers now expect EDR or MDR |
|
Immutable, tested backups |
Follow the 3-2-1 rule, keep one copy that can't be altered, and test restores on a schedule |
Ransomware targets backups first; untested backups often fail when needed |
|
Patch and vulnerability management |
Patch internet-facing systems fast and retire unsupported software |
Exploited vulnerabilities are now the top way attackers get in |
|
Email security |
SPF, DKIM and DMARC set to enforce, plus filtering for phishing |
Blocks spoofing and business email compromise |
|
Least-privilege access |
Separate admin accounts, regular access reviews, prompt offboarding |
Limits how far an attacker can move with one compromised account |
|
Security awareness training |
Onboarding plus ongoing training, including text and phone scams |
People are involved in most breaches; SMS and voice phishing now outperform email |
|
Incident response plan |
A written plan, tested in a tabletop exercise at least once a year |
Faster containment directly lowers breach costs |
|
Encryption |
Sensitive data encrypted at rest and in transit, including on laptops |
Over half of breached organizations had not encrypted sensitive data |
|
Vendor and AI governance |
Review vendor security, limit their access, and approve which AI tools staff may use |
Third parties and unapproved AI are two of the fastest-growing leak paths |
If you already follow a framework such as the NIST Cybersecurity Framework 2.0 or CIS Controls, these items map to its core safeguards. If you don't, this list is a practical place to start.
An assessment shows you exactly where you stand before an attacker, an insurer or a client finds the gaps for you. A practical first pass takes four steps:
Compass can run this assessment with you and show you where your business meets minimum security standards and where it falls short. Start with our Cybersecurity Assessment Guide, or contact your account manager or email contactus@compassmsp.com to get started.