Basic cybersecurity for a small or mid-sized business comes down to a few actions: turn on two-factor authentication on every account (starting with email and the bank), use a password manager, keep everything updated, have tested backups, give each person only the access they need, train the team to recognize phishing and have a written plan for the day of an incident. In Mexico, the personal data law already requires you to protect your customers' data and to notify them if it is breached.
Where does a small or mid-sized business start with cybersecurity?
With a simple framework, not by buying tools. The most widely used is the NIST Cybersecurity Framework, whose version 2.0 was published on February 26, 2024. It is voluntary, works for companies of any size and organizes security into six functions:
| Function | The question it answers | Example in a small or mid-sized business |
|---|---|---|
| Govern | Who decides and what risks do we accept? | A named owner and an equipment use policy |
| Identify | What do we have to protect? | A list of systems, accounts and sensitive data |
| Protect | How do we prevent harm? | Two-factor authentication, updates, backups |
| Detect | How do we find out? | Antivirus, alerts for failed sign-ins |
| Respond | What do we do when it happens? | Incident plan with who to call |
| Recover | How do we get back to operating? | Restore backups in the right order |
NIST also published a quick-start guide for small and mid-sized businesses "with modest or nonexistent cybersecurity plans." Almost everything that follows comes from there and from the guides of CISA, the United States cybersecurity agency.
What does the law in Mexico require on cybersecurity?
Today, what most directly binds a private company is the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties, LFPDPPP), published on March 20, 2025. Its article 18 requires administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized access. And its article 19 requires you to notify affected individuals immediately when a security breach significantly affects their property or moral rights.
And what is new heading into 2027? On December 17, 2025, the Política General de Ciberseguridad para la Administración Pública Federal (General Cybersecurity Policy for the Federal Public Administration) was published in the Diario Oficial, and the Agencia de Transformación Digital (Digital Transformation Agency) has a training program for 2026–2027 pending in its cybersecurity agenda for the federal administration. Both are aimed at the federal government, not private companies. If you sell to the government, ask what they will require of you as a vendor. For your specific case, consult your legal advisor.
What it costs you to ignore it: besides the damage from the attack, having to tell your customers their data was exposed without having taken the measures the law already required.
What are the basic controls and how much effort do they take?
| Control | What it prevents | Effort |
|---|---|---|
| Two-factor authentication (MFA) on all accounts | A stolen password being enough to get in | Low |
| Password manager | Reused or weak passwords | Low |
| Automatic updates | Attacks through already known flaws | Low to medium |
| Tested backups | Losing everything to ransomware or a failure | Medium |
| Minimal access and no administrator rights on laptops | A mistake or an intruder reaching everything | Medium |
| Disk encryption on laptops | Data leaks if a device is lost or stolen | Low |
| Phishing training | Someone handing over a password or opening a malicious file | Medium |
| Written incident plan | Improvising at the worst moment | Low |
The effort level is our own estimate for a company of 20 to 200 people; the controls come from NIST's small business guide and CISA's guide.
Why is two-factor authentication first?
Because it is one of the cheapest and fastest things you can do. NIST puts it this way: turning on multifactor authentication is one of the quickest and least expensive ways to protect your data, and it recommends starting with the accounts holding the most sensitive information: bank, accounting and tax, email and the password manager itself.
CISA adds two useful ideas: any two-factor method is better than none, and the only widely available one that resists phishing is based on the FIDO standard. It also asks that two-factor authentication be mandatory by configuration, not on good faith.
It applies the same way in your ERP. Odoo, for example, lets you require two-factor authentication for all employees or all users from the permissions settings. If a user loses their phone, an administrator has to disable it so they can sign in again, so define that procedure beforehand.
How important is keeping everything updated?
Very. CISA considers it one of the most cost-effective practices for improving your security, and in its ransomware guide it asks you to prioritize servers exposed to the internet. It also acknowledges that small businesses struggle to keep them up to date, and therefore suggests moving to managed cloud providers to reduce, not eliminate, that work.
This includes your ERP. Odoo only publishes security updates for each version during its three years of standard support; if your system runs an old version on your own server, it has been left without patches. We explain the hosting differences in Odoo Online, Odoo.sh or your own server on AWS, and if your installation is already behind, in Odoo rescue. If you have nobody to keep your servers up to date, that can also be delegated to an infrastructure.
How do you protect email and the team from phishing?
With configuration and with practice. What CISA recommends in its ransomware guide:
- An awareness and training program for all staff.
- Flag emails that come from outside the company.
- Filter the attachment types that often carry malicious programs.
- Disable macros in Office files that arrive by email.
And a golden rule for management: no change to a vendor's bank account and no urgent transfer is authorized by email or WhatsApp alone; it is confirmed through another channel with someone you know.
What should you check with your technology vendors?
NIST asks you to assess the risks of vendors and third parties before you start working with them. Three minimum questions for whoever hosts or administers your systems: who on their team has access to my data and with what two-factor authentication?, how and how often do they back up, and when was the last restore test?, how do they notify me if there is an incident? If backups raise doubts for you, read the 3-2-1 rule explained for a small and mid-sized business.
The same applies if you use artificial intelligence with customer data; we cover it in how to protect your customers' data when you use AI.
What should you do if your company suffers an attack?
Follow the plan you wrote beforehand. According to NIST's guide, a basic response plan includes an owner, the list of who to call (management, technical contact, legal, bank, insurer) and what you must report, to whom and when, under laws and contracts.
In Mexico, the Guardia Nacional (National Guard), through its CERT-MX response team, receives incident reports and guides complaints at the citizen hotline 088. It recommends saving evidence (screenshots, messages, receipts) and not sharing it publicly. If personal data was significantly affected, remember the obligation to notify the data subjects.
What should you do in the next 90 days?
- Week 1: name an owner and make the list of systems, accounts and sensitive data.
- Weeks 2 to 4: mandatory two-factor authentication on email, bank, ERP and the password manager; remove administrator rights from laptops.
- Month 2: review updates and backups, and run a test restore.
- Month 3: phishing training and a drill of the incident plan with management present.
Glossary
- Two-factor authentication (MFA or 2FA)
- Asking for something more than the password to sign in, such as a code from the phone or a physical key.
- Phishing
- A fake message that poses as someone trustworthy to steal passwords or money.
- Ransomware
- Malicious software that encrypts your files and demands a ransom.
- Patch
- An update that fixes a known security flaw.
- Security breach
- An incident in which data is lost, altered or ends up within reach of someone who should not have it.
Frequently asked questions
Is a small or mid-sized business really a target for attacks?
Yes. CISA warns that small businesses often lack the resources to defend themselves against threats like ransomware, which is why the basic recommendations matter even more.
Do I need to hire a security department?
Not to start. NIST suggests relying on a provider that monitors devices and networks if you lack in-house resources, but management can lead the basic controls.
Is antivirus enough?
No. It helps detect, but it does not stop someone from getting in with a stolen password; that is what two-factor authentication is for.
Is there a cybersecurity law for companies in Mexico?
As of November 2026, what directly binds private companies on this topic is the personal data law. The cybersecurity policy published in December 2025 is for the federal government.
Where do I report a cybercrime?
To the Guardia Nacional's 088 line, which guides you on filing the complaint. Save the evidence before you call.
Sources: NIST, “NIST Releases Version 2.0 of Landmark Cybersecurity Framework”, February 26, 2024 · NIST SP 1300, “CSF 2.0: Small Business Quick-Start Guide”, February 2024 · CISA, “Cyber Guidance for Small Businesses”, April 2024 · CISA, “#StopRansomware Guide”, September 2023 · Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20-03-2025, last amended 14-11-2025) · DOF, “Acuerdo por el que se emite la Política General de Ciberseguridad para la Administración Pública Federal”, December 17, 2025 · Agencia de Transformación Digital y Telecomunicaciones, cybersecurity agenda · Guardia Nacional, “Campaña Nacional de Ciberseguridad 2026”, February 26, 2026 · CERT-MX, “Recomendaciones en caso de ser víctima de un ciberdelito”, July 2, 2024 · Odoo documentation, “Two-factor authentication” · Odoo documentation, “Standard and extended support”
