Protecting Customer Data in a Small Trade Business: A Practical Checklist

What customer data a trade business holds

Even a two-truck business usually keeps more than it realizes: customer names, home addresses, phone numbers and emails, gate or lockbox codes, photos of the inside of homes, invoices and payment records, and logins to job software, email and the bank. A stolen email password can expose all of it, because password resets for most other accounts go to that inbox.

CISA’s four core steps

The Cybersecurity and Infrastructure Security Agency (CISA), in its Secure Our World program, says everyone should take these four steps:

1. Avoid and report phishing scams. Be suspicious of urgent messages asking you to log in, pay an invoice or change bank details, even if they appear to come from a supplier or customer. Check by calling a number you already have.
2. Use strong passwords. A different, long password for every account, especially email, banking, payroll and job software.
3. Use multifactor authentication (MFA) and a password manager. A password manager makes unique passwords practical for a whole crew.
4. Update software. Turn on automatic updates for phones, tablets, laptops, browsers and your website.

CISA lists additional steps for organizations of all sizes, including using logging on your systems, backing up data, encrypting data, reporting cyber incidents to CISA, having an incident response plan and using it, and being prepared for system disruptions.

Multifactor authentication: not all methods are equal

The National Institute of Standards and Technology (NIST) explains on its Small Business Cybersecurity Corner that MFA asks for more than one of these:

• Something you know (a password or PIN).
• Something you have (a smart card or security key).
• Something you are (a fingerprint or face).

NIST says enabling MFA on all accounts that offer it is essential, but some forms, such as one-time PINs and SMS text codes, can be phished. It names FIDO authenticators used with the W3C Web Authentication standard as the most common phishing-resistant option, either as a separate hardware key or built into a phone or laptop. In practice: turn on MFA everywhere it is offered, and check the security settings of your email, bank and payroll accounts for a phishing-resistant option.

Backups, payments and devices

The U.S. Small Business Administration (SBA) recommends:

• Backing up data regularly and, if possible, to cloud storage weekly.
• Keeping payment systems separate from other, less secure programs and working with your bank or card processor to use trusted tools.
• Checking with your vendors whether they offer multi-factor authentication for accounts like financial, accounting and payroll.

For field crews, add simple device rules: a screen lock on every phone and tablet used for jobs, no shared logins, and removing a worker’s access to job apps and email on their last day. If you are choosing job software, our field service software checklist covers security questions to ask.

Collect less, keep less

• Don’t write full card numbers on paper work orders or text them. Use your payment processor’s own tools.
• Store gate and lockbox codes in your job software (with access limited to the crew who needs them), not in group texts.
• Delete old photos and files you no longer need, after checking how long tax and business records must be kept.

State example (California): reasonable security and breach notices

California only. Other states have their own rules.

• Reasonable security (Civil Code 1798.81.5). A business that owns, licenses or maintains personal information about California residents must implement and maintain reasonable security procedures and practices appropriate to the nature of the information. A business that discloses that information to a third party under contract must require the third party by contract to do the same.
• Breach notice deadline (Civil Code 1798.82, as amended by SB 446, effective January 1, 2026). Notice to affected California residents must be made within 30 calendar days of discovery or notification of the breach. A delay is allowed for the legitimate needs of law enforcement or as necessary to determine the scope of the breach and restore the reasonable integrity of the system.
• Format. The notice must be in plain language, titled “Notice of Data Breach,” with the headings “What Happened?”, “What Information Was Involved?”, “What We Are Doing,” “What You Can Do,” and “For More Information.”
• Attorney General. If more than 500 California residents are notified for a single breach, a sample copy of the notice must be submitted electronically to the Attorney General within 15 calendar days of notifying consumers.
• What counts. “Personal information” includes, among other things, a name with a Social Security number, driver’s license number, or a financial account or card number with the code needed to access it, and a username or email address combined with a password or security question and answer that would permit access to an online account.

Text from the California Legislative Information website, checked October 30, 2026.

A one-page incident plan

CISA recommends having an incident response plan and using it. For a small business, one page is enough to start:

1. Who to call first: your IT help (if any), your bank or card processor, your insurance carrier.
2. How to lock things down: change the email password, sign out all sessions, check email forwarding rules, review MFA settings.
3. Where your backups are and how to restore them.
4. Who decides whether customers must be notified, and which state laws apply. Talk to an attorney.
5. How to report the incident to CISA.