IT Security in La Crosse: A Checklist for Businesses With Under 100 Employees

For a business with fewer than 100 employees, La Crosse IT security comes down to 10 controls: multifactor authentication, prompt updates, tested backups, monitored endpoint protection, email and payment safeguards, staff training, tight administrator access, a locked-down network, encrypted personal data, and a written incident plan. If you can only fix three this quarter, fix the first three. They deal with stolen passwords, known software holes, and ransomware that goes after your backups.

Wisconsin is not exempt. In 2025, the FBI's Internet Crime Complaint Center (IC3) received 16,680 complaints from Wisconsin, with $194,227,722 in reported losses, according to the FBI's 2025 IC3 annual report (opens in a new tab). The checklist below is written for owners and office managers in La Crosse, Onalaska, Holmen and West Salem, not for IT staff. Use it to grade your own setup, or hand it to whoever runs your computers. If you want a local team to check it with you, that is the job of our cybersecurity services in La Crosse.

The three La Crosse IT security controls to fix first#

Multifactor authentication#

Microsoft says that, based on what it has learned, more than 99.9% of common identity-related attacks are stopped by multifactor authentication and blocking legacy authentication (opens in a new tab). Few changes buy that much protection for so little money. Turn it on for email first, then banking, payroll, remote access and every administrator account.

Updates applied in days, not months#

Attackers reuse flaws that are already public. CISA, the federal cyber defense agency, keeps a catalog of vulnerabilities that have been exploited in the wild (opens in a new tab) and tells organizations to use it as an input when deciding what to patch first. For a small business, that means automatic updates on every computer, plus someone who confirms that the firewall, servers and business software actually got patched.

Backups that ransomware cannot reach#

CISA's #StopRansomware Guide (opens in a new tab) says to keep offline, encrypted backups of critical data and to test them regularly, because many ransomware variants try to find and delete or encrypt any backups they can reach. A backup on the same network, behind the same password, is just one more copy for the attacker to lock.

The La Crosse IT security checklist: 10 controls for businesses under 100 employees#

Each item has one line on why it matters and one on what "done" looks like. If you cannot honestly say yes to the "done" line, the item goes on your to-do list.

1. MFA on email, money and remote access#

Why: A stolen password alone should never be enough to get in.

Done looks like: Every user has MFA on Microsoft 365 or Google Workspace, and on your bank, payroll, accounting software and remote access. Administrators use it at every sign-in. CISA's MFA guidance says any MFA is better than no MFA (opens in a new tab), but the standard to strive for is phishing-resistant MFA, and the only widely available kind is FIDO/WebAuthn. Move the people who can send money or change settings to it first.

2. Patches on a schedule, urgent fixes within days#

Why: Updates close holes that attackers already know about.

Done looks like: Windows and Mac updates install automatically, and a monthly report shows which machines are behind. Firewalls, servers and line-of-business applications are on the patch list too, not just laptops. Anything on CISA's known-exploited list jumps the queue.

3. Backups you have actually restored from#

Why: The only proof that a backup works is a successful restore.

Done looks like: Servers, the workstations that hold files, Microsoft 365 mail and files, and your line-of-business data are all backed up. At least one copy is offline or cannot be changed from your network. Someone restores a real file or system on a schedule and writes down how long it took.

4. Endpoint detection and response, watched around the clock#

Why: An alert that nobody reads at 2 a.m. on a Saturday protects nothing.

Done looks like: Every computer and server runs endpoint detection and response (EDR). CISA's ransomware guide recommends EDR or application allowlisting on all assets. Alerts go to a person or team 24 hours a day. You know who that is, and what they may do without calling you first, such as isolating a computer or disabling an account.

5. Email authentication and a call-back rule for money#

Why: Nationwide, phishing and spoofing was the most-reported crime type to the IC3 in 2025, with 191,561 complaints, and business email compromise accounted for $3,046,598,558 in reported losses, per the same IC3 report (opens in a new tab).

Done looks like: SPF, DKIM and DMARC are set up for your email domain, so receiving servers can check that mail from you really came from you. The FTC explains all three in its cybersecurity guidance for small businesses (opens in a new tab). Any request to change bank details or send a wire is confirmed by calling a number you already had on file, never one from the email. Our post on business email compromise shows how the fake invoice version plays out.

6. Security training that happens more than once a year#

Why: Your staff see the phishing email before any tool does.

Done looks like: Short training through the year, simulated phishing emails, and an easy, no-blame way to report something odd. CISA's guide recommends an awareness program that teaches people how to identify and report suspicious activity such as phishing. Our security awareness training combines short courses, phishing simulations and progress tracking.

7. Separate admin accounts and same-day offboarding#

Why: An attacker who takes over an administrator account controls everything that account can touch.

Done looks like: Nobody reads email or browses the web while signed in as an administrator. CISA's guide says to separate administrator accounts from user accounts. Shared logins are gone, and passwords live in a business password manager, not a spreadsheet. The FTC recommends passwords of at least 12 characters that are never reused. When someone leaves, every account is disabled that day, including Microsoft 365, the accounting system, remote access and vendor portals.

8. A locked-down firewall, Wi-Fi and remote access#

Why: Anything reachable from the internet can be found and tried by anyone.

Done looks like: A business-grade firewall that is kept updated and monitored. Remote desktop is never exposed directly to the internet; CISA's guide says plainly, "Do not expose services, such as remote desktop protocol, on the web." Remote staff connect through a VPN or similar gateway that requires MFA. Guest Wi-Fi is separate from the network your computers use. Per the FTC, the router's default name and password are changed and WPA2 or WPA3 encryption is turned on.

9. Know where personal information lives, and encrypt it#

Why: Under Wisconsin law, encryption can decide whether a stolen laptop is a reportable breach (more on that below).

Done looks like: You can list every place your business stores Social Security numbers, driver's license numbers, and bank or card numbers: HR files, payroll, customer records, scanned forms sitting in email. The FTC recommends encrypting laptops, tablets, smartphones, removable drives and other media that hold sensitive personal information. Old files you no longer need are deleted.

10. A written incident response plan, on paper#

Why: The worst time to look for your cyber insurance carrier's phone number is when every computer in the office is locked.

Done looks like: One or two pages that say who makes decisions, who to call (your IT provider, your insurance carrier, your bank's fraud line, your attorney), how staff report a problem, and where the offline backups are. CISA recommends keeping a hard copy and an offline version of the plan. Walk through it with your leadership team once a year.

What Wisconsin § 134.98 requires when a control fails#

Wisconsin's data breach notification law, Wis. Stat. § 134.98 (opens in a new tab), covers businesses based in Wisconsin, businesses that maintain or license personal information here, and out-of-state businesses whose records on Wisconsin residents are taken. Personal information means a person's name linked to a Social Security number, a driver's license or state ID number, a financial account or card number (or a code that opens the account), a DNA profile, or unique biometric data, when that element is not encrypted, redacted or otherwise made unreadable. If you learn that someone unauthorized acquired it, you must make reasonable efforts to notify each person "within a reasonable time, not to exceed 45 days" after you learn of it. If one incident requires notice to 1,000 or more people, you must also notify the nationwide consumer reporting agencies without unreasonable delay.

That is why items 9 and 10 are on this checklist. Encrypted data generally falls outside the statute's definition of personal information, and good records plus a written plan are how you work out what was taken inside 45 days. Our full walkthrough of the Wisconsin data breach notification law covers the exceptions, the law enforcement delay and how the statute treats non-compliance. This is general information, not legal advice. If you think you have had a breach, call your attorney first. Healthcare, financial and other regulated businesses may have federal rules on top of this one.

How to check your business against this list#

Mark each of the 10 items yes, partly or no. Any "no" in items 1 to 3 is this month's work. For the rest, ask your IT provider to show you, not tell you: the MFA report, the patch report, the date and result of the last restore test, and who answered the last overnight security alert.

If you do not have anyone to ask, or you want a second opinion, a security assessment does that check for you. It can include vulnerability scanning and a review of your security posture and policies, and it ranks the fixes by actual risk. Our managed cybersecurity services handle much of this list on an ongoing basis: 24/7 network monitoring, automated patching, threat detection, dark web monitoring, security awareness training and quarterly security scans.

We are based in Holmen, and our engineers work on-site across La Crosse, Onalaska, West Salem and the rest of the Coulee Region, not from a remote-only help desk. See our full range of IT services in La Crosse.

Book a security assessment#

Not sure how many of the 10 you can check off? Book a security assessment with our La Crosse cybersecurity team. It is free, with no commitment required, and includes a vulnerability scan of your environment, a dark web credential check, a risk prioritization report and remediation recommendations. You can do the fixes yourself or with us.

Frequently asked questions#