​Small businesses should adopt multi-factor authentication on all accounts and have three copies of their data, among other practices.