The Small Business Cybersecurity Checklist

Small businesses get attacked for the same reason big ones do: they have money, data, and email accounts that can be used to trick customers. A short list of basics blocks the attacks that hit small businesses most often: stolen passwords, phishing, unpatched software, and ransomware.

This checklist is in priority order. If you only get through the first section this month, you've already made the business much harder to break into. There's also a one-page printable version to tick off as you go.

Start here: the five highest-impact steps#

These come first because they block the most common attacks for the least effort, and most cost nothing.

1. Turn on multi-factor authentication (MFA) everywhere it matters

   Start with email, then banking, payroll, accounting, your domain registrar, cloud storage, and any admin accounts. CISA ranks MFA methods from strongest to weakest: a physical security key first, then an authenticator app with number matching, then app codes, with text or email codes as the last resort (but still far better than nothing). Passkeys use the same phishing-resistant standard as security keys.

2. Use a password manager and stop reusing passwords

   A business password manager gives everyone long, unique passwords, lets you share logins safely, and lets you revoke access when someone leaves.

3. Turn on automatic updates

   For Windows, macOS, phones, browsers, and the router/firewall. Most successful attacks use flaws that already have fixes.

4. Back up, including one copy attackers can't delete

   Follow the 3-2-1 Backup Guide, keep one copy immutable or offline, and test a restore.

5. Separate admin accounts from everyday accounts

   Nobody should read email or browse the web while signed in as an administrator. See "Administrative accounts" below.

Multi-factor authentication#

• Turn it on for every user, not just owners. Attackers target whichever account is easiest.
• Prefer phishing-resistant methods for admins and anyone handling money: passkeys or hardware security keys (FIDO2/WebAuthn). CISA's phishing-resistant MFA fact sheet explains why.
• If you use push notifications, make sure number matching is on so a stray "Approve?" prompt can't be accepted by mistake. Microsoft Authenticator now does this for every push notification.
• Microsoft 365 without Conditional Access: turn on security defaults. They're free, and Microsoft already turns them on for new tenants. They make every user register for MFA (the Microsoft Authenticator app or another authenticator app; text messages aren't an option), require MFA every time an admin signs in, and block older sign-in methods that can't do MFA.
• Microsoft 365 with Conditional Access: Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. If you use it, turn security defaults off and build the same protections as policies; Microsoft provides ready-made ones.
• Google Workspace: enforce 2-Step Verification in the Admin console and allow security keys or passkeys.

Password managers#

What to look for in a business password manager:

• Shared vaults or collections with per-person permissions
• Admin controls: require MFA, remove access when someone leaves, recover accounts
• Breach monitoring that flags reused or exposed passwords
• Works on every device your staff use

Two widely used options are 1Password and Bitwarden (open source, with a free individual tier). Both offer business plans; compare the admin features you need and current pricing.

Password guidance has changed. NIST's digital identity guidelines (SP 800-63B-4) favor long passwords or passphrases: at least 15 characters for a password used on its own (8 when it's one part of multi-factor sign-in), with room for 64 or more. They also call for checking new passwords against lists of breached and common passwords, allowing password managers and paste, and not forcing periodic changes unless there's evidence of compromise. Complex character rules mostly push people into predictable patterns. A password manager makes all of this easy.

Device updates and inventory#

• Keep an inventory of every computer, phone, tablet, and network device: who uses it, its operating system version, and whether it's still supported. Replace devices that no longer get security updates.
• Automatic updates on, with restarts actually happening (set a weekly restart window if needed).
• Update browsers and the apps that open files (PDF readers, office suites). Those are common ways in.
• Network equipment: routers, firewalls, and VPNs need updates too. Internet-facing VPN and firewall flaws are frequent targets; check CISA's Known Exploited Vulnerabilities catalog if you're unsure whether an update is urgent.

Endpoint security#

• Use the built-in protection well before buying more: Microsoft Defender Antivirus on Windows and XProtect/Gatekeeper on macOS are on by default. Don't turn them off.
• Turn on full-disk encryption: BitLocker on Windows, FileVault on Mac. A lost laptop then isn't a data breach. Store the recovery keys in your admin account, not on a sticky note.
• Consider a managed endpoint product (endpoint detection and response) when you have more than a handful of devices or sensitive data. Microsoft 365 Business Premium includes Microsoft Defender for Business, and it's also sold on its own for organizations of up to 300 users; check what your licenses already include.
• Standard user accounts for daily work (see "Least privilege").

Backups#

Covered in depth in the 3-2-1 Backup Guide. The security-specific points:

• One backup copy immutable or offline, so ransomware can't delete it.
• Backup systems use separate credentials with MFA.
• Test restores at least quarterly.
• Don't forget cloud data in Microsoft 365 or Google Workspace.

Network segmentation#

• Separate guest Wi-Fi from business devices, always.
• Put smart devices, cameras, and printers on their own network where your equipment supports it.
• Don't expose Remote Desktop, file shares, or admin pages to the internet.

The network guide explains how to set up guest and IoT networks and the firewall rules between them.

Least-privilege access#

• People get access to what their job needs, and no more. A front-desk account doesn't need the accounting share.
• Daily work happens in standard (non-admin) accounts on computers. Installing software requires an admin login.
• Review access when roles change, and remove it the same day someone leaves: email, shared drives, password manager, line-of-business apps, and building access.
• Use groups to grant access rather than individual permissions, so changes are easy to see.

Email security#

Email is where most attacks start.

• SPF, DKIM, and DMARC records on your domain make it harder for criminals to send email pretending to be you. Start DMARC at p=none to collect reports, then move to quarantine or reject once legitimate mail passes.
• Turn on your platform's advanced filtering for attachments and links if your plan includes it.
• Tag external email (for example a banner saying "External sender") so look-alike messages stand out.
• Disable automatic forwarding to outside addresses, a common way attackers quietly copy mailboxes.
• Verify payment changes out of band. Any request to change bank details or pay a new account gets a phone call to a number you already have, never the one in the email. This one habit defeats the most common business email compromise scam: the fake request to change where a payment goes.

Phishing awareness#

Short, regular reminders beat annual hour-long training:

• Teach people the warning signs: urgency, secrecy, unusual payment requests, unexpected attachments, and login pages reached from a link.
• Make it easy and blame-free to report a suspicious email or an accidental click. Fast reporting matters far more than never making a mistake.
• Show a real example from your own inbox every month or two.

Mobile device security#

• Screen lock with a PIN or biometrics, and automatic updates on.
• Company data on personal phones: use your platform's app protection or device management (for example Microsoft Intune or Google endpoint management) so you can remove business data from a lost or departing employee's phone without wiping their personal data.
• Find-my-device turned on, so a lost phone can be located or erased.
• Install apps only from official app stores.

Remote access#

• Use a VPN or a zero-trust access product with MFA, never port-forwarded Remote Desktop.
• Keep the VPN appliance updated; it's one of the most attacked things a small business owns.
• Prefer cloud apps with MFA over remote access into the office network when that's an option.

Administrative accounts#

• Separate admin accounts (for example admin.jordan@) used only for administration, with phishing-resistant MFA.
• At least two admins for every critical system (email, domain registrar, DNS, firewall, payroll), so you're never locked out if one person is unavailable.
• Emergency ("break-glass") accounts for your email platform, used only if every normal admin is locked out. Microsoft recommends two of them for Microsoft 365, created as cloud-only accounts on your onmicrosoft.com domain. Microsoft now requires MFA to reach its admin portals, so a password alone won't get in: give each account a hardware security key (passkey) that your daily admins don't use, and keep the keys locked away in separate places. Exclude these accounts from any Conditional Access policy that blocks sign-in, get an alert whenever one is used, and test them every quarter.
• No shared admin logins. Each admin gets their own, so actions can be traced.
• Keep a list of who has admin rights to what, and review it quarterly.

Logging and monitoring#

You don't need a security operations center, but you should be able to answer "what happened?" after an incident.

• Turn on audit logging in Microsoft 365 or Google Workspace and know how long logs are kept on your plan.
• Turn on alerts for suspicious sign-ins, new mailbox forwarding rules, and admin role changes.
• Review sign-in activity for admin accounts monthly.
• Keep firewall and backup logs long enough to look back a few weeks.

Incident response preparation#

Decide now, while it's calm:

1. Who to call

   Write down the IT help you'd call, your cyber insurance carrier's claims line (if you have a policy, call them early; many require you to use their vendors), your bank's fraud line, and a lawyer if you hold customer data.

2. First moves

   Disconnect affected computers from the network (don't power them off: evidence may be lost), change passwords from a clean device, and contact your bank immediately if money moved. Wire transfers can sometimes be recalled if you act within hours.

3. Where to report

   Report cybercrime to the FBI at ic3.gov and to CISA. If personal information was exposed, follow the FTC's data breach response guide and your state's notification laws.

4. Where the plan lives

   Print it and keep it somewhere other than the computers that might be encrypted, along with offline copies of key phone numbers.

Vendor and SaaS security#

Your data lives in other companies' systems too.

• Keep a list of the services the business uses and who the admin is for each.
• Turn on MFA and single sign-on where offered, and remove former employees from every service.
• Ask key vendors how they protect your data: MFA for their staff, backups, breach notification, and where your data is stored.
• Limit third-party app permissions in Microsoft 365 and Google Workspace. Review which apps users have connected, and require admin approval for new ones.
• Read the contract's security and breach-notification terms for anything holding customer or financial data.

Practical implementation priorities#

For a structured way to keep going, NIST's Small Business Quick-Start Guide to the Cybersecurity Framework is free and written for businesses your size. CISA's Cross-Sector Cybersecurity Performance Goals are written for critical-infrastructure organizations, but they make a good prioritized baseline for any business.