I think the comments so far are too harsh. The purpose of this document is to lay out, in plan language, what should be the minimum requirements for a small business in terms of cyber security. If there's no place to start, small business won't even be able to try. Following this document probably also will help with legal liability should the company have an incident. If you followed these steps, you're probably less likely to have liability then if you didn't.