Small Business Cybersecurity Checklist: What to Do First
Cybersecurity advice can feel endless, and small businesses rarely have a security team. The good news is that a short list of basics blocks many of the most common attacks: stolen passwords, phishing emails, unpatched software and ransomware.
This checklist is ordered by priority. Work from the top down. Each step is useful on its own, so progress counts even if you cannot do everything at once.
Priority 1: Do these this month
- Turn on multi-factor authentication (MFA) everywhere you can. Start with email, Microsoft 365 or Google Workspace, banking, payroll, accounting, your domain registrar and any admin accounts. MFA means a stolen password alone is not enough to get in.
- Use a business password manager. Give every employee one, require unique passwords for every account, and stop sharing passwords by email or spreadsheet.
- Turn on automatic updates. For operating systems, browsers and common apps on every computer and phone. Replace devices that no longer receive security updates.
- Back up critical data and test a restore. Follow the 3-2-1 rule: three copies, on two types of storage, with one off-site. Keep at least one copy that ransomware cannot reach.
- Remove old accounts. Disable access for former staff and contractors immediately, and review who has admin rights.
Priority 2: Do these within three months
- Protect every device. Use reputable endpoint protection on all computers. Many businesses now use endpoint detection and response (EDR) tools, which watch for suspicious behavior rather than only known viruses.
- Tighten email security. Enable your email provider's built-in filtering and set up the email authentication records known as SPF, DKIM and DMARC, which make it harder for criminals to send email pretending to be you.
- Train your staff. Short, regular sessions on spotting phishing, fake invoices and urgent payment requests. Make it easy and blame-free to report a suspicious email.
- Verify payment changes. Any request to change bank details or send an urgent payment should be confirmed by phone using a number you already have, never one from the email.
- Remove everyday admin rights. Staff should not use administrator accounts for daily work.
- Secure your Wi-Fi. Use a strong password and current encryption, change default router passwords, and keep a separate guest network for visitors.
Priority 3: Do these within six to twelve months
- Encrypt laptops and phones. Built-in tools such as BitLocker on Windows and FileVault on Mac protect data if a device is lost or stolen.
- Manage devices centrally. Device management tools let you enforce updates, encryption and screen locks, and wipe a lost device remotely.
- Write a simple incident response plan. Who to call, how to isolate an infected computer, how to contact your bank, insurer and IT provider, and when to notify customers or authorities.
- Review vendor access. List which outside companies can reach your systems or data, and make sure their access is limited and protected with MFA.
- Look at cyber insurance. Read the requirements carefully. Many policies expect controls such as MFA, backups and EDR.
- Check your obligations. Businesses handling health data, payment cards, financial data or government contracts may have specific security requirements. Get professional advice if unsure.
Quick reference
| Control | Protects against | Typical effort |
|---|---|---|
| MFA | Stolen and reused passwords | Low |
| Password manager | Weak and shared passwords | Low |
| Automatic updates | Known software flaws | Low |
| Tested backups | Ransomware, deletion, hardware failure | Medium |
| EDR / endpoint protection | Malware and suspicious activity | Medium |
| Email authentication | Spoofing and impersonation | Medium |
| Staff training | Phishing and payment fraud | Ongoing |
| Incident plan | Slow, confused response | Low |
What it costs
Many of the most important steps cost little or nothing: MFA, automatic updates and email authentication are usually included in tools you already pay for. Password managers, EDR and security awareness training are typically priced per user per month, and costs vary by vendor and features. A managed IT or security provider can bundle these together. Get quotes from more than one provider and ask exactly what is included.
Free resources worth knowing
US government agencies publish free guidance for small businesses. The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission (FTC) and the Small Business Administration (SBA) all offer plain-language security guides, and the National Institute of Standards and Technology (NIST) publishes small-business resources based on its Cybersecurity Framework.
The bottom line
You do not need a large budget to make your business much harder to attack. Turn on MFA, use a password manager, keep software updated and maintain tested backups first. Then add device protection, email security, staff training and an incident plan. Review the checklist once a year, and whenever your business or systems change.