October is Cybersecurity Month: 8 controls every small business should have before year-end

October is Cybersecurity Awareness Month, and in the Dominican Republic you can tell. Banco Popular launched a campaign around an easy-to-remember idea, “2FA: Double-Factor Attention”: before any important digital action, take a few extra seconds to check that the request or transaction is legitimate. And from October 14 to 16, as part of ITLA Security Fest 2026, the final of the Inter-University CTF takes place, with more than 500 students registered.

It’s good news that the topic is part of the conversation. But the attacks that hurt small businesses the most are rarely sophisticated: a reused password, an email asking to change a supplier’s bank account, an unpatched computer. So this is the minimum checklist we recommend having in place before December.

The 8 controls

1. Two-factor authentication wherever possible. Email, online banking, social media, hosting and domain. If someone gets your password, the second factor is what stops them.

2. A different password for every service. With a password manager for the whole team. Reusing passwords is the most common way a leak on another site ends up in your account.

3. Backups you can actually restore. The 3-2-1 rule: three copies, on two different media, one off-site. And test a restore at least once: a backup that was never tested isn’t a backup.

4. Automatic updates. Operating system, browser, website plugins and point-of-sale software. Many attacks exploit flaws that already had a fix.

5. Verify before you pay. If a supplier “changes bank accounts” by email or WhatsApp, confirm by phone using a number you already had. That’s double-factor attention applied to your business.

6. Least privilege, same-day offboarding. Everyone gets access only to what they need. When someone leaves the team, their access is removed that day, not the following week.

7. Separate Wi-Fi, and caution in public. One network for the business and another for guests. And no banking from public Wi-Fi.

8. A plan for the bad day. One page listing who to call, where the backups are and how to notify clients. The Dominican National Cybersecurity Center (CNCS) publishes a guide to identifying and reporting incidents that works as a starting point.

Also: your customers’ data

If you store customers’ personal data —names, ID numbers, phone numbers, histories— the Dominican Law 172-13 on data protection requires it to be protected with technical and organizational measures that prevent unauthorized access. Security isn’t just a technical topic: it’s also an obligation.

And with e-invoicing, even more so

With mandatory electronic invoicing, more of your operations depend on digital credentials, certificates and connected systems. Include those accesses in points 1, 2 and 6.

If you want help

At Hekonix we review the security of websites, servers and internal systems, set up backups and monitoring, and document it all for your team. Get in touch and we’ll start with an assessment.