Small Business Cybersecurity Checklist: Practical Steps to Reduce Risk
A practical checklist covering accounts, backups, devices, email, updates, vendors, and incident response.
Protect accounts
Enable MFA for email, financial services, cloud administration, and remote access. Use unique passwords in a password manager and remove access promptly when staff leave.
Maintain devices
Turn on supported updates, replace unsupported systems, restrict local administrator rights, and inventory laptops, phones, servers, cloud services, and important applications.
Test backups
Keep protected backups of critical data and configurations, separate backup administration from everyday accounts, and regularly test restoration.
Reduce email fraud
Verify payment-detail changes using a known second channel and configure SPF, DKIM, and DMARC appropriately. Make it easy for staff to report suspicious messages.
Prepare for incidents
Document contacts, containment decisions, evidence guidance, vendors, and communications responsibilities. Practice a realistic scenario and assign owners to gaps.