How small businesses can build a secure cybersecurity program without third-party vendors using open-source tools and internal governance.