Purpose -The objective of this study is to gather information about information technology (IT) related security issues in small firms in both manufacturing and service. Design/methodology/approach -Despite its widely acknowledged importance, the academic research in the area of information systems security issues for small businesses is almost negligible. To fill this gap, a questionnaire was mailed to 1,000 small business owners in Lynchburg, Virginia, USA, and 138 valid responses were received. Findings -The results of this study indicate that the small business owners may have procedures and policies in place and may use technologies to counteract the security threat, but this research raised doubts about their effectiveness. Originality/value -The data collected through this research will help small business organizations in planning, training, and exploitation of IT.