Small Business Cybersecurity Checklist (Printable)

Work down the list in order. Each item is explained in the full checklist.

This week#

• MFA on email, banking, payroll, accounting, and the domain registrar
• Microsoft 365: security defaults on, or Conditional Access policies that require MFA
• No Remote Desktop, file shares, or admin pages open to the internet
• Backups exist, and one copy is offsite
• Rule: payment and bank-detail changes are confirmed by phone, using a number you already have

This month#

• Password manager for everyone; no reused passwords
• Passwords of 15+ characters where a password is the only sign-in step; no forced periodic changes
• Separate admin accounts, with security keys or passkeys
• Two emergency admin accounts, each with its own security key, stored apart
• Automatic updates on for computers, phones, browsers, and the router or firewall
• Full-disk encryption: BitLocker (Windows) or FileVault (Mac), recovery keys saved
• Guest Wi-Fi separated from business devices

This quarter#

• Inventory of devices, accounts, and online services, with an admin named for each
• One backup copy that can't be deleted (immutable or offline), and a test restore
• SPF, DKIM, and DMARC on your domain (start DMARC at p=none)
• Automatic forwarding to outside addresses turned off
• Audit logs on; alerts for risky sign-ins, new forwarding rules, and admin changes
• Written incident plan, printed and stored away from the computers

On a schedule#

• Monthly: updates applied; admin sign-in activity reviewed
• Quarterly: access review, restore test, emergency accounts tested
• Every month or two: a short phishing reminder with a real example
• Every departure: access removed the same day (email, files, password manager, apps, building)

If something goes wrong#

Disconnect affected computers from the network (don't power them off), change passwords from a clean device, and call your bank at once if money moved. Report cybercrime at ic3.gov.