Free guides and checklists

Straight answers. No sales pitch.

Everything on this page is free and short enough to read on a break. It is written to be read once and acted on, not to make you feel behind. Pick the side that sounds like you.

Which one are you?
I run a small businessNo IT person. Nothing technical, I promise. ↓Someone is asking us to prove we are secureCMMC, HIPAA, FTC Safeguards, security questionnaires. ↓
Small business

Written for the owner who is also the IT person.

If a guide needs a translator, we wrote it badly. Everything below is plain English, short enough to read on a break, and specific enough to do something with today.

Free guide
Hackers Don't Skip Small Businesses. They Prefer Them.
AveLu Tech
3 pages6 minute readNo jargon

The short version of what actually protects you.

Small businesses get hit more often than big ones, not less, because attackers assume nobody is watching. This is the list of what stops most of it. Most of it is free and none of it needs an IT department.

What's inside
✓The five fixes that stop most attacks, in the order to do them
✓The 10-second check that catches fake invoice emails
✓A 10-minute self-check you can run on your own, today
✓What to do first if you only have one hour this month
Get the guide →

Or just do these five things this week. No email required.

This is the honest short version of the guide. If you do nothing else on this page, do these.

1
Turn on two-step login
Your email is the key to everything else you own. Two-step login blocks the most common way people get in, which is a stolen password. It is free and takes about an hour for a small team.
2
Check that your backup actually works
Having a backup and having a backup that restores are two different things. Pick one file and try to get it back. If you cannot, you do not have a backup, you have a hope.
3
Stop clicking “remind me later”
Those update prompts are mostly security patches for holes that are already public. Set them to install overnight and stop thinking about it.
4
Teach your team the 10-second check
Unexpected, urgent, and asking for money, passwords or gift cards? Stop and call the person. Every time, especially when it looks like it came from you.
5
Write down who has access
A former employee, an old bookkeeper, the person who built your website three years ago. If you cannot list who can get in, you cannot remove them either.
That is genuinely the whole list. Do those five and you are ahead of most small businesses in the country. If you want a second set of eyes on it, the 30-minute call is free and there is no pitch attached.
Monthly, free
The SMB Intel Brief
One email a month. Three things worth your attention, written the same way this page is. No spam, and you can unsubscribe in one click.
Sign up →
Growth and compliance

For when someone else is grading your homework.

A customer sends a security questionnaire. An insurer asks for proof of multi-factor authentication. A contract names a framework you have never read. These are written for the person who has to answer, not for a compliance department.

Free guide
Your Primes Are Asking About CMMC. Here Is What They Actually Mean.
AveLu Tech
3 pages7 minute readReadiness, not certification

What the requirement means, without the clause numbers.

Most suppliers hear about CMMC from a prime, not from the Department of Defense, and the letter never explains what is actually being asked. This lays out what applies to you, by when, and what it takes to get there.

What is inside
✓Level 1 versus Level 2, and how to tell which one applies to you
✓What the phased rollout means for your actual contract dates
✓Why your SPRS score is already visible to your primes right now
✓The five steps from where you are to where you need to be
✓A six-question readiness check you can answer in ten minutes
Get the guide →

Not sure which rule is the one aimed at you?

Start with whichever sentence sounds like something that has actually happened to you in the last year.

A prime asked about CMMC or NIST 800-171
You supply into defense, aerospace or a federal contract. Someone sent a flow-down clause and expected you to know what it meant.
See what that takes →
We handle patient records
A practice, a lab or a clinic. HIPAA has applied to you the whole time, and your insurer has started asking how you handle it.
See what that takes →
We hold privileged client files
Your corporate clients have started sending their vendor security reviews to their outside counsel. That now includes you.
See what that takes →
We handle customer financial data
An advisory practice, a CPA firm, an insurance agency or a lender. The FTC Safeguards Rule applies whether or not anyone told you.
See what that takes →
One thing worth saying plainly: AveLu prepares you and documents the work. We are not a certifying body, and no IT provider can make you certified or guarantee an audit outcome. Anyone who tells you otherwise is selling something.
Both guides, one form

Tell us where to send them.

You get both guides as PDFs, straight away. Tell us your industry and we will point you at the one that fits your situation first, so you are not reading the wrong one. No sales call unless you ask for one.

✓Delivered by email in under a minute
✓No credit card, no trial, nothing to install
✓We never sell or share your details

More guides are on the way. If you are stuck on something that is not covered here, reply and tell us what it is. That is usually how the next one gets written.

andres@avelutech.com · (984) 489-0899

📅 Book a 30-Minute Call