It is 4:17 on a Friday afternoon.
An employee receives an email that appears to be from the owner:
"Can you send me the updated banking information before you leave?"
The name is right.
The tone sounds familiar.
The request does not seem completely unreasonable.
And everyone is trying to finish the week and head home.
There is only one problem.
The owner never sent it.
Your IT provider can put strong cybersecurity protections in place. Email filtering, endpoint protection, multifactor authentication, firewalls, backups, monitoring, and other security tools can stop a tremendous amount of malicious activity before it ever reaches an employee.
But technology cannot make every decision for your team.
At some point, a person still has to decide whether to trust an email, approve a request, open a document, send information, or stop and ask a question.
For Small/Medium Businesses (SMB's) throughout North Dakota, South Dakota, and Minnesota, that means cybersecurity cannot belong to IT alone.
Cybersecurity is a business responsibility, and every employee has a role to play.
Quick Answer: Is Cybersecurity Just the IT Department's Responsibility?
No.
IT professionals and managed IT providers are responsible for implementing and managing many of the technical protections that help secure a business. However, employees and leadership also play critical roles.
Employees make decisions every day about emails, passwords, files, payments, vendors, and access to information. Leadership establishes the expectations, policies, and culture that determine how employees respond when something seems suspicious.
The strongest cybersecurity strategy combines:
- Technology
- Employee awareness
- Clear procedures
- Leadership support
- Fast reporting
- Ongoing training
Cybersecurity works best when everyone understands their responsibility.
The Assumption That Can Leave a Business Exposed
Many business owners think about cybersecurity as something happening quietly in the background.
The computers have antivirus.
Someone handles software updates.
The firewall is installed.
Backups are running.
The IT provider is monitoring things.
So cybersecurity feels "handled."
Those protections are important.
But your security is also tested every time an employee receives an unusual email or request.
Should they trust the link?
Is that invoice legitimate?
Did the owner really ask for those gift cards?
Did the vendor actually change banking information?
Should that employee have access to this file?
Was that unexpected multifactor authentication prompt something they initiated?
These are everyday decisions, and cybercriminals know it.
That is why today's attacks often target people instead of trying to break through technology directly.
Cybercriminals Are Getting Better at Looking Legitimate
The suspicious emails businesses received years ago were often easier to recognize.
Poor grammar.
Strange formatting.
Obvious spelling mistakes.
An unfamiliar sender.
A ridiculous request.
Those attacks still exist, but many modern phishing and social engineering attacks are much more convincing.
An attacker may impersonate:
- An owner
- A manager
- A coworker
- A customer
- A bank
- A payroll company
- A software provider
- A trusted vendor
The message may sound normal.
It may reference a real project.
It may even match the way someone typically communicates.
Artificial intelligence has made it easier for attackers to create professional, personalized, and convincing messages at scale.
That means employees cannot rely solely on bad spelling or an unusual-looking email to identify a threat.
Sometimes the most important cybersecurity tool is simply knowing when to stop and verify.
Technology Cannot Make Every Call
Good cybersecurity tools can block a lot.
But no tool can eliminate every suspicious request or make every business decision for an employee.
Consider a few scenarios.
A vendor emails your accounting department saying their banking information has changed.
A manager asks an employee to send sensitive information quickly.
Someone receives an unexpected Microsoft 365 login prompt.
A coworker shares a document the employee was not expecting.
A customer sends an unusual attachment.
Any of those situations could be completely legitimate.
They could also be part of an attack.
The employee at the keyboard may have only a few seconds to decide what happens next.
That is why cybersecurity awareness matters.
Employees do not need to become cybersecurity experts.
They need to recognize when something deserves a second look.
"Be Careful" Is Not a Cybersecurity Plan
One of the most common pieces of cybersecurity advice is also one of the least helpful:
"Be careful."
Of course employees should be careful.
But what does that actually mean?
If something looks suspicious, employees should know exactly what to do next.
A good security process should answer questions such as:
- Who should I contact?
- How do I verify an unusual request?
- What should I do with a suspicious email?
- Should I forward it?
- What happens if I already clicked the link?
- What if I entered my password?
- What if I downloaded an attachment?
- What if I am not sure whether something is legitimate?
Those answers should not require employees to guess.
Clear procedures make good decisions easier.
Make Verification Normal
Verification is one of the simplest ways businesses can reduce risk.
If a vendor suddenly changes banking information, verify it using a known phone number.
If the owner sends an unusual financial request, confirm it another way.
If someone asks for sensitive information unexpectedly, stop before sending it.
That extra verification may take a few minutes.
Recovering from fraudulent payments, compromised accounts, or stolen information can take significantly longer.
Leadership should make verification normal.
Employees should never feel awkward because they double-checked something.
A healthy security culture sends the message:
If something feels unusual, verify it.
Employees Need to Know What to Do After a Mistake
There is another important part of cybersecurity awareness that businesses sometimes overlook.
What happens after someone clicks?
People make mistakes.
Someone may click a phishing link.
They might enter a password into the wrong website.
They could approve an unexpected login prompt.
They may download something they should not have.
At that moment, speed matters.
The employee should know exactly who to contact and feel comfortable reporting what happened immediately.
They should not spend 30 minutes wondering whether the problem is serious.
They should not wait until tomorrow.
And they should not try to hide it because they are worried about getting in trouble.
The faster your IT provider knows what happened, the faster they can investigate and potentially contain the issue.
A Blame Culture Can Make Cybersecurity Worse
How leadership responds to mistakes matters.
Imagine an employee accidentally clicks a malicious link.
They immediately realize something is wrong.
If their first thought is:
"I am going to get in trouble for this."
they may hesitate to report it.
That delay can make the situation worse.
Instead, businesses should encourage immediate reporting.
That does not mean mistakes do not matter.
It means the priority in the moment should be protecting the business.
Investigate first.
Contain the risk.
Learn from what happened.
Then determine whether training, procedures, or technical protections should be improved.
Employees who feel comfortable speaking up give your IT team something extremely valuable:
time.
Leadership Sets the Cybersecurity Culture
Employees pay attention to what leadership actually does, not simply what the employee handbook says.
If an owner routinely ignores security procedures because they are inconvenient, employees notice.
If a manager constantly asks employees to bypass processes because something is urgent, employees notice.
If leadership complains about multifactor authentication every time it appears, employees notice.
Eventually, the message becomes clear:
Convenience matters more than security.
The opposite can also be true.
When leadership follows verification procedures, employees are more likely to follow them too.
When leaders thank employees for reporting suspicious activity, employees become more comfortable speaking up.
When managers take cybersecurity training seriously, employees are more likely to do the same.
Security culture starts at the top.
Cybersecurity Training Should Be Practical
Cybersecurity training should not feel like something employees click through once a year and immediately forget.
It should help them handle situations they may actually encounter.
For example:
What does a phishing email look like?
How should an employee respond to an unexpected multifactor authentication request?
What should accounting do when a vendor changes banking information?
How should an employee verify a request supposedly coming from the owner?
What happens if someone enters credentials into a suspicious website?
When should employees contact IT?
Training should make cybersecurity easier to understand, not more intimidating.
Short, ongoing education can help keep security top of mind without overwhelming employees.
Employee Onboarding Should Include Cybersecurity
Security awareness should begin when an employee joins the company.
New employees should understand:
- How to contact IT
- How passwords should be managed
- How multifactor authentication works
- What information should be protected
- How suspicious emails should be reported
- How unusual requests should be verified
- What company devices can and cannot be used for
- What to do if something goes wrong
Cybersecurity should feel like a normal part of working at the company.
Not something employees suddenly hear about after an incident.
Offboarding Matters Too
When an employee leaves your business, cybersecurity responsibilities do not end.
Access should be removed promptly.
That may include:
- Microsoft 365
- VPN access
- Business applications
- Shared files
- Cloud services
- Password managers
- Administrative accounts
- Third-party platforms
Company equipment should also be accounted for.
For Small/Medium Businesses (SMB's), a documented onboarding and offboarding process helps ensure these steps happen consistently instead of depending on someone remembering every detail.
Leadership Should Know the Cybersecurity Basics
Business owners do not need to understand every cybersecurity tool.
But leadership should understand the basics of how the business is protected.
You should be comfortable asking your IT provider:
Are we using multifactor authentication where we should be?
How are suspicious emails being filtered?
What happens if an employee clicks something malicious?
Are our employees receiving cybersecurity awareness training?
How do employees report suspicious activity?
Are our backups monitored and tested?
Who has administrative access?
How quickly is access removed when an employee leaves?
What would we do if our systems were unavailable tomorrow?
Your IT partner should be able to answer those questions clearly.
Cybersecurity should not feel like a mysterious technical subject that leadership simply has to trust is being handled.
The Role of Your Managed IT Provider
Your managed IT provider should help build both sides of your cybersecurity strategy.
The technology side
That can include:
- Email security
- Endpoint protection
- Multifactor authentication
- Firewalls
- Security monitoring
- Patch management
- Backups
- Device encryption
- Access controls
- Password management
The people and process side
That can include:
- Cybersecurity awareness training
- Phishing simulations
- Employee onboarding
- Employee offboarding
- Incident reporting procedures
- Security policies
- Business continuity planning
- Leadership guidance
Technology and people should work together.
One without the other leaves gaps.
What Does a Strong Security Culture Look Like?
A strong security culture does not mean employees are afraid to open an email.
It means they know what to do when something feels unusual.
Employees understand that verifying a request is expected.
They know who to contact.
They report mistakes quickly.
Leadership supports the process.
The IT provider provides ongoing guidance.
And everyone understands that protecting the business is a shared responsibility.
That is very different from telling employees once a year:
"Don't click suspicious links."
Why This Matters for SMBs in ND, SD, and MN
Small and medium-sized businesses throughout North Dakota, South Dakota, and Minnesota often operate differently than very large organizations.
Teams may be smaller.
Employees may wear several hats.
The owner may still be closely involved in daily operations.
Accounting staff may personally know the vendors they work with.
There may not be an internal cybersecurity department watching every transaction.
Those close relationships are valuable.
But cybercriminals can also exploit them.
An email that appears to come from the owner can feel believable because employees know the owner personally.
A request from a familiar vendor may receive less scrutiny.
A rushed employee may act quickly because helping each other is simply how the business operates.
The solution is not to remove that trust.
It is to combine trust with good verification habits.
Cybersecurity Works Better When Everyone Knows Their Role
Now go back to that employee at 4:17 on Friday afternoon.
They receive what appears to be an email from the owner asking for banking information.
The goal is not for that employee to panic.
It is not for them to become suspicious of every message.
It is for them to think:
"This is unusual. I know exactly what I am supposed to do."
They verify the request.
They discover it was fraudulent.
They report it.
And everyone heads home for the weekend.
That is what a healthy cybersecurity culture looks like.
Not perfection.
Preparation.
Cybersecurity Is Everyone's Responsibility, But You Do Not Have to Manage It Alone
At Information Management Systems, we believe cybersecurity should be understandable and practical.
Your employees should know their role.
Your leadership team should understand your risks.
And your technology should provide layers of protection behind the scenes.
We help Small/Medium Businesses (SMB's) throughout North Dakota, South Dakota, and Minnesota identify potential security gaps, strengthen their technology, prepare employees, and build processes that make it easier to respond when something does not look right.
Because cybersecurity is not just an IT responsibility.
It is a business responsibility.
If you are not sure whether your employees would know what to do if a suspicious email landed in their inbox tomorrow, it may be time for a conversation.
Schedule a discovery call with Information Management Systems at 701-364-2718 or visit imsnetworking.com.
Frequently Asked Questions About Employee Cybersecurity
1. Is cybersecurity the responsibility of IT or employees?
Cybersecurity is a shared responsibility. IT professionals and managed IT providers manage technical protections such as email security, endpoint protection, multifactor authentication, backups, and monitoring. Employees help protect the business by recognizing suspicious activity, following security procedures, verifying unusual requests, and reporting potential incidents quickly.
2. Why are employees important to small business cybersecurity?
Employees interact with email, passwords, financial requests, business applications, customer information, and cloud services every day. Cybercriminals often target employees through phishing and social engineering because convincing a person to provide access can be easier than attacking security technology directly. Employee cybersecurity awareness is therefore an important layer of protection for Small/Medium Businesses (SMB's).
3. What should an employee do if they receive a suspicious email?
An employee should avoid clicking links, downloading attachments, replying, or providing information until the message has been verified. They should follow the company's reporting process and contact their IT provider or designated internal contact. If the employee has already interacted with the email, they should report it immediately so the issue can be investigated.
4. How often should small businesses provide cybersecurity awareness training?
Cybersecurity awareness should be an ongoing process rather than a once-a-year activity. Small and medium-sized businesses should reinforce security throughout the year with practical training, reminders, phishing simulations, and updates when new risks emerge. New employees should also receive cybersecurity guidance during onboarding.
5. How can businesses in North Dakota, South Dakota, and Minnesota improve their cybersecurity culture?
SMBs in North Dakota, South Dakota, and Minnesota can improve cybersecurity culture by setting clear reporting procedures, providing regular employee training, normalizing verification of unusual requests, encouraging fast reporting of mistakes, using strong technical safeguards, and making cybersecurity part of leadership conversations. A managed IT provider can help businesses combine the right technology, employee education, and processes into a more complete cybersecurity strategy.
