Information Security Roadmap for Small Business: A 12-Month Plan

An information security roadmap is a written, prioritized plan. It says what you will fix, in what order, who owns each piece, and by when. It turns “we should really do something about security” into a calendar you can fund. This guide gives you a practical 12-month version built on NIST and CISA guidance, with Virginia specifics.

You are busy. The phone is ringing, an invoice is late, and someone just forwarded a strange email. Security gets pushed to next week. A roadmap stops that slide.

TL;DR

• A roadmap is a ranked list of gaps and fixes, not a shopping list of tools. Buying tools one at a time is the most common SMB mistake.
• Use NIST CSF 2.0 as the skeleton: Govern, Identify, Protect, Detect, Respond, Recover.
• Start with where you are today (your Current Profile), then pick a realistic Target Profile. You do not need everything at once.
• Move email and files to a secured cloud platform early. It gives you guardrails fast.
• In Virginia, some businesses, such as insurance licensees, have legal duties. Your roadmap should name them.

Table of Contents

• What a security roadmap is (and what it isn’t)
• Step 1: Take a clear look at where you stand
• Step 2: Decide what “good enough” looks like
• Step 3: Build the 12-month roadmap
• Fold compliance into the plan, not on top of it
• A free framework you can borrow today
• A simple roadmap template you can copy
• Mistakes that stall a roadmap
• Our perspective
• How Total Cyber can help
• FAQ
• Sources

What a security roadmap is (and what it isn’t)

It is not a policy binder. It is not a one-time audit. It is not a list of products.

A roadmap sits between your risk and your budget. Gartner describes it as a way to prioritize projects against gaps, and that is the right idea. We would add one thing: it has to be readable by the person who signs the checks.

CISA’s guidance for small businesses makes the same point from another angle. It offers an action plan built around how attacks actually happen, and it splits tasks by role, starting with the CEO. Security is a leadership job first and an IT job second.

Step 1: Take a clear look at where you stand

Before you plan anything, write down what you have. Not what you think you have.

• People: who has access to what? Who left last year and still has a login?
• Devices: laptops, phones, printers, that old server in the closet.
• Data: customer records, payment details, health or legal files, employee data.
• Vendors: who touches your data besides you?
• Incidents: what has already gone wrong, even if it was small?

NIST calls the result a Current Profile. The Organizational Profiles quick-start guide explains that a profile describes your current and target security posture in terms of outcomes. You can do a rough one on a whiteboard in an afternoon.

If you want an outside view, a formal check helps. Our guide to security posture assessments explains what one covers. A vulnerability analysis adds the technical side: what is actually exposed.

Step 2: Decide what “good enough” looks like

Now pick a target. This is where many owners freeze, because they think the target is perfection.

It isn’t. NIST’s CSF Tiers guide describes Tiers as a way to characterize the rigor of your risk governance and management. Think of them as a ladder, from informal and reactive to repeatable and risk-informed. A ten-person accounting firm does not need the same rung as a defense contractor.

Ask three questions:

1. What would hurt most if it stopped for a week?
2. What data would cause real harm if it leaked?
3. Who, if anyone, requires us to meet a standard? Customers, insurers, regulators, prime contractors?

Your answers shape the Target Profile. Write it down in plain sentences, like “Every employee uses multi-factor sign-in” or “We can restore payroll data in a day.”

Step 3: Build the 12-month roadmap

Here is a phased plan. Adjust the timing to your size and risk. The order matters more than the exact months.

The six functions come straight from the NIST Small Business Quick-Start Guide. The guide was written for organizations with modest or no cybersecurity plans, which is probably you.

Phase 1 (months 1 to 3): Foundations

Start with governance. That sounds heavy. It isn’t.

• Name one person who owns security decisions. If that is not you, say who it is.
• Make a simple inventory of devices, apps and data.
• Turn on backups, and test one restore. Not just “it says it ran.”
• Remove accounts that no one uses.
• Write a short acceptable-use policy. Our piece on cybersecurity policies for SMB owners shows what to include.

No budget for a full-time security lead? That is normal. A virtual Chief Security Officer (vCSO) can own the roadmap without a full-time salary. We cover that under our services.

Phase 2 (months 3 to 6): Core protections

This is where the click happens, so this is where you add guardrails.

Move to a secured cloud platform if you have not already. CISA’s small business guidance supports using cloud services as a way to shift base-level infrastructure security onto the provider. Microsoft 365 and Google Workspace are the usual choices. See our cloud security benefits guide for the practical upside.

Then layer on:

• Multi-factor authentication for email, banking and remote access.
• Automatic updates and a patching routine.
• Email filtering for phishing links and malicious attachments.
• Short, regular staff training. Ten minutes a month beats a two-hour session once a year.

Our seven-first checklist lines these up in priority order, aligned to NIST and CIS.

Phase 3 (months 6 to 9): Visibility

You cannot respond to what you cannot see. This phase adds:

• Security monitoring and alerting on endpoints and email.
• Regular vulnerability scanning. Here is why scanning matters for risk management.
• A review of who has admin rights.

If you handle sensitive data or run a customer-facing web app, consider penetration testing now. It tests whether your new protections hold up. It belongs after the basics, not before.

Phase 4 (months 9 to 12): Readiness

Something will eventually go wrong. The question is whether anyone knows what to do at 4:55 on a Friday.

• Write an incident response plan with names and phone numbers.
• Run a 30-minute tabletop: “A staff member clicked a bad link. Now what?”
• Test a full restore of your most important system.
• Review your key vendors’ security.

Virginia businesses can use our breach response planning steps as a starting template.

Fold compliance into the plan, not on top of it

Compliance is not a separate project. It is a set of requirements your roadmap should already be meeting.

Some examples of what can apply:

• HIPAA for healthcare and their business associates.
• CJIS for those who touch criminal justice information.
• CMMC for defense contractors. Start with our CMMC overview and breakdown of the CMMC levels.
• State law. In Virginia, the Insurance Data Security Act is a real example. Section 38.2-623 requires licensees to maintain a written, risk-based information security program scaled to their size, activities and use of third-party providers. Check the text, and ask your attorney whether you are a licensee.

The same statute family reaches into incident handling. Section 38.2-624 covers investigating a cybersecurity event. Licensees need an incident plan and record-keeping, so build those into Phase 4. Confirm exact retention periods in the code itself or with counsel.

Healthcare teams also have to think about everyday workflows such as outreach and calls. This overview of HIPAA-compliant outreach for healthcare administrators shows how compliance duties show up in routine operations, which is the same lesson a roadmap teaches.

A word on vendors. Your accountant, payroll provider and software tools all touch your data. Put them on the roadmap: ask what they do for security, and write down their answers. Regulators often expect you to own that question.

For policy work, see our Policy Compliance service.

A free framework you can borrow today

You do not need to invent a method. Two public ones fit small businesses well.

NIST CSF 2.0. Free, flexible, and written in plain outcomes. Our explainer for business leaders and plain-English NIST guide translate it.

CISA Cross-Sector Cybersecurity Performance Goals. The CPGs 2.0 report is a voluntary set of baseline practices, and CISA notes that small and medium-sized organizations often have limited budgets, staffing and expertise. It maps to the NIST CSF, so you can use the two together.

If you are in Virginia, the Virginia SBDC cybersecurity page lists webinars and resources for small companies.

A simple roadmap template you can copy

Open a spreadsheet. Make these columns:

Sort by risk first, then effort. Do the high-risk, low-effort rows first. Review it every quarter, and every time something changes: a new office, a new app, a new contract.

Mistakes that stall a roadmap

• Starting with tools. Software without a plan leaves gaps and overlaps.
• Trying to do everything. A short list that gets finished beats a long one that doesn’t.
• No owner. “Everyone” owns it means nobody does.
• Skipping the restore test. A backup you have never restored is a hope.
• Forgetting people. Most attacks start with a message someone reads between tasks.
• Treating it as done. Threats change. So should the plan.

Our perspective

We see the same pattern again and again. A business has a firewall here, an antivirus there, and no one can say what the whole setup is meant to do. The owner is not careless. They were busy.

We built our approach on one belief: security should be part of how IT is run, not an add-on. That is why our managed services are staffed by senior cybersecurity professionals rather than IT generalists, and why compliance readiness is part of the work from the start.

Our advice on a roadmap is simple. Keep it short. Make it honest. Put the first ninety days on one page. And pick a partner who will explain the plan in words you would use yourself.

— Alden

How Total Cyber can help

We are a veteran-owned cybersecurity and IT services company. We can run the roadmap with you: assessments, managed IT, managed cybersecurity, cloud services, compliance consulting and vCSO leadership. Our approach combines all-inclusive pricing, clear communication and U.S.-based 24/7 support.

Want a second pair of eyes on your plan? Request a discovery call and we will talk through where you are and what to do first.

FAQ

How long should an information security roadmap be?

One to three pages is plenty for most small businesses. Put the next 90 days in detail and the rest in broad strokes. If nobody reads it, it is too long.

How often should I update it?

Review it every quarter and after any big change, like a new system, vendor or contract. Do a fuller reset once a year. Treat it as a living document, not a project that ends.

Do I need a framework like NIST, or can I just make a checklist?

A checklist is a start, but a framework keeps you from missing whole areas. NIST CSF 2.0 is free and written for organizations of all sizes, and its small business guide is a good place to begin. You can use it loosely.

What should I do first if I have almost no budget?

Nominate an owner, list your data and accounts, turn on multi-factor authentication, and test your backups. These steps cost mostly time. They address common ways attacks succeed.

Does Virginia law require a security program?

It depends on your business. Insurance licensees fall under Virginia Code § 38.2-623, which requires a written, risk-based program. Other industries face HIPAA, CJIS or contract terms instead. Ask your attorney which apply to you.

Sources

• NIST CSF 2.0 Small Business Quick-Start Guide
• NIST CSF 2.0 Organizational Profiles quick-start guide
• NIST CSF 2.0 Tiers quick-start guide
• CISA Cyber Guidance for Small Businesses
• CISA Cross-Sector Cybersecurity Performance Goals 2.0
• Code of Virginia § 38.2-623
• Code of Virginia § 38.2-624
• Virginia SBDC cybersecurity resources
• Gartner: Creating an Effective Cybersecurity Roadmap

Recommended

• Do These 7 First for Small Business Cybersecurity (NIST and CIS Aligned)
• Cloud Security Benefits for Small Businesses: 2026 Guide
• Small Business Wi-Fi Security Hardening: 2026 Guide
• Small Business Security Operations Center: 2026 Guide