# Small Business Cybersecurity Checklist (Printable)

This is a plain-text copy of a cheatsheet published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/cheatsheets/cybersecurity-checklist-printable

- Source (authoritative web version): https://jeremiahellington.com/resources/cheatsheets/cybersecurity-checklist-printable
- Author: Jeremiah Ellington
- Published: 2026-10-25
- Last updated: 2026-10-25
- Last reviewed: 2026-10-25
- Next scheduled review: 2027-04-30
- Applies to: Small businesses using Windows/macOS computers and Microsoft 365 or Google Workspace. Companion to the full guide, which explains each item

The one-page version of the Small Business Cybersecurity Checklist: what to do this week, this month, this quarter, and on a schedule, with space for your emergency contacts.

---

Work down the list in order. Each item is explained in the [full checklist](https://jeremiahellington.com/resources/small-business-cybersecurity-checklist).

## This week

- [ ] MFA on email, banking, payroll, accounting, and the domain registrar
- [ ] Microsoft 365: security defaults on, or Conditional Access policies that require MFA
- [ ] No Remote Desktop, file shares, or admin pages open to the internet
- [ ] Backups exist, and one copy is offsite
- [ ] Rule: payment and bank-detail changes are confirmed by phone, using a number you already have

## This month

- [ ] Password manager for everyone; no reused passwords
- [ ] Passwords of 15+ characters where a password is the only sign-in step; no forced periodic changes
- [ ] Separate admin accounts, with security keys or passkeys
- [ ] Two emergency admin accounts, each with its own security key, stored apart
- [ ] Automatic updates on for computers, phones, browsers, and the router or firewall
- [ ] Full-disk encryption: BitLocker (Windows) or FileVault (Mac), recovery keys saved
- [ ] Guest Wi-Fi separated from business devices

## This quarter

- [ ] Inventory of devices, accounts, and online services, with an admin named for each
- [ ] One backup copy that can't be deleted (immutable or offline), and a test restore
- [ ] SPF, DKIM, and DMARC on your domain (start DMARC at `p=none`)
- [ ] Automatic forwarding to outside addresses turned off
- [ ] Audit logs on; alerts for risky sign-ins, new forwarding rules, and admin changes
- [ ] Written incident plan, printed and stored away from the computers

## On a schedule

- [ ] **Monthly:** updates applied; admin sign-in activity reviewed
- [ ] **Quarterly:** access review, restore test, emergency accounts tested
- [ ] **Every month or two:** a short phishing reminder with a real example
- [ ] **Every departure:** access removed the same day (email, files, password manager, apps, building)

## If something goes wrong

Disconnect affected computers from the network (don't power them off), change passwords from a clean device, and call your bank at once if money moved. Report cybercrime at [ic3.gov](https://www.ic3.gov/).

| Who to call | Name and number |
|---|---|
| IT help | |
| Insurance claims line | |
| Bank fraud line | |
| Lawyer | |

---

## Sources and official documentation

- [Ellington Technologies: The Small Business Cybersecurity Checklist (full guide and its sources)](https://jeremiahellington.com/resources/small-business-cybersecurity-checklist)
- [CISA: Cyber Guidance for Small Businesses](https://www.cisa.gov/cyber-guidance-small-businesses)
- [NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [Microsoft Learn: Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-25
- Editorial review: Jeremiah Ellington, 2026-10-25