The Small Business Cybersecurity Checklist: 10 Essentials to Put in Place Now

Most small businesses don’t skip security because they don’t care. They skip it because the advice is overwhelming and written for companies with an IT department. This small business cybersecurity checklist narrows it to ten essential controls, with why each matters and how to set it up without a security team.

Many attacks on small businesses aren’t sophisticated. They exploit a reused password, an unpatched laptop, a fake invoice or an ex-employee’s account nobody switched off. Each gap has a known, affordable fix, often a setting in tools you already pay for.

Work through the list, give every item an owner and use the printable checklist to make security a routine.

Key takeaways

• Turn on multifactor authentication (MFA) everywhere, starting with email, admin and banking accounts, and prefer passkeys or security keys.
• A password manager, automatic updates and tested 3-2-1 backups close the most common gaps and make recovery possible.
• Verify every payment or bank-detail change by phone, using a number you already have on file.
• Give people only the access they need, and remove it the day they leave.
• Write a one-page incident response plan now, while nothing is on fire.

How to Use This Checklist

MFA, strong passwords, updates and phishing awareness are the basics in CISA’s small-business guidance, so start there. A realistic pace:

1. Week 1: MFA on critical accounts, a password manager, automatic updates.
2. Week 2: Backups, device encryption and screen locks.
3. Week 3: Email authentication, a payment-verification rule, an access review.
4. Week 4: Wi-Fi settings, a vendor review and your incident response plan.

1. Turn On MFA Everywhere (Prefer Phishing-Resistant Methods)

Why it matters: A stolen password alone can hand over an account. MFA adds a second proof of identity, but not all MFA is equal: texted or app-generated codes can be captured by a fake login page.

CISA advises businesses to aim for phishing-resistant MFA, starting with admin accounts and employees who handle sensitive data. Adapted from its ranking:

MFA method	Protection level	Use it for
Passkeys or hardware security keys (FIDO)	Strongest, phishing-resistant	Admins, email, banking, finance staff
Authenticator app with number matching	Good	Everyone else by default
Authenticator app with one-time codes	Moderate	When number matching isn’t offered
Text or email codes	Weakest	Only when nothing stronger exists

How to do it:

• Start with accounts that unlock everything else: email, workspace admin, domain registrar, bank, payroll and password manager. Email comes first because most password resets land there.
• Enforce MFA from your Google Workspace or Microsoft 365 admin console rather than making it optional.
• Give each admin a backup key or passkey, and store recovery codes in your password manager.

2. Use a Password Manager for the Whole Team

Why it matters: Reused passwords turn one breach into many. A password leaked from another site can unlock company email if reused there.

How to do it:

• Choose a business password manager (1Password and Bitwarden are well-known examples) with an admin console and shared vaults.
• For passwords people must type, follow CISA’s baseline: at least 16 characters (a random mix or a passphrase of five to seven unrelated words), used for only one account.
• Move shared logins out of spreadsheets and chat into shared vaults.
• Protect the password manager with your strongest MFA, and set up account recovery so the business isn’t locked out if the founder is unreachable.

3. Automate Updates and Patching

Why it matters: Updates fix security flaws that attackers actively look for. Software that has reached end of life gets no fixes at all.

How to do it:

• Turn on automatic updates for operating systems, browsers and apps on every computer and phone, and set a restart deadline so updates actually install.
• Keep a simple inventory of devices and software, and replace anything its maker no longer supports.
• Include the less visible systems: routers, firewalls, printers and your website’s content management system, themes and plugins.
• Ask any IT provider how they prioritize urgent patches, for example with CISA’s Known Exploited Vulnerabilities catalog.

4. Back Up Using the 3-2-1 Rule and Test Your Restores

Why it matters: Backups turn ransomware, a stolen laptop or an accidental deletion into an inconvenience rather than a crisis. A backup you’ve never restored is only a hope.

CISA’s guidance on backing up business data recommends the 3-2-1 rule: three copies of important files, on two types of storage, with one copy off-site.

How to do it:

• List the data you can’t operate without: customer, financial and payroll records, email, contracts and website databases.
• Automate backups, keep one copy offline or protected from deletion, and encrypt them.
• Sync isn’t backup: a deleted or ransomware-encrypted file can sync straight to the cloud. Check how far back each app’s version history goes.
• Test a restore every quarter. CISA also suggests confirming you can roll data back at least seven days.

5. Secure and Encrypt Every Device

Why it matters: Laptops get left in cabs and phones get stolen. Without encryption, whoever holds the device can often read its contents.

How to do it:

• Turn on full-disk encryption: BitLocker or Device Encryption on Windows (depending on edition), FileVault on Mac. Most modern smartphones encrypt storage once a passcode is set.
• Require a screen lock after a few minutes of inactivity.
• Keep built-in protections such as Microsoft Defender and the firewall on, and enable remote location and wipe.
• Beyond a handful of devices, consider mobile device management (MDM) to enforce these settings centrally.
• Personal devices that touch company data need, at minimum, a current operating system, a screen lock and MFA.

6. Harden Email and Train Your Team to Spot Phishing

Why it matters: Phishing emails try to steal logins or plant malware. Business email compromise (BEC) is subtler: an attacker impersonates an executive, vendor or client and asks for a wire transfer or new bank details. The message looks routine, so filters alone won’t catch it. A process will.

How to do it:

• Authenticate your domain with SPF, DKIM and DMARC to make spoofing your domain harder. The FTC’s cybersecurity guidance for small businesses explains all three plainly.
• Turn on your provider’s filtering for spam, malware and impersonation, plus warning banners on external email.
• Adopt a call-back rule. Verify any payment-change or unusual payment request by phone, using a number already on file, never one from the email. The FTC recommends having staff call to confirm emailed wire requests, and the FBI’s IC3 advises verifying account changes through a secondary channel.
• Require two people to approve payments above a set amount.
• Train little and often, since CISA’s guidance says once-a-year training isn’t enough, and make reporting blame-free.

If money has already gone out, IC3 says to contact your bank immediately to request a recall or reversal, then file a complaint.

7. Apply Least-Privilege Access and Offboard the Same Day

Why it matters: Excess access makes every mistake or compromise worse, and former staff with live logins are an avoidable risk.

How to do it:

• Give everyone a standard account for daily work; admins use a separate admin account only for admin tasks.
• Keep admin rights to a small group, but at least two people so you can’t lock yourself out.
• Restrict finance, payroll and customer data to the roles that need them, and review access quarterly.
• Use sign-in with Google or Microsoft where possible, so disabling one account closes most doors. Our guide to a lean startup tech stack covers that identity foundation.

Same-day offboarding:

1. Disable the workspace account and sign out all sessions.
2. Remove password manager access and change shared passwords the person knew.
3. Transfer ownership of files, calendars and shared inboxes.
4. Remove access to banking, payroll, domain and payment tools.
5. Recover or remotely wipe company devices.

8. Lock Down Your Wi-Fi and Network

Why it matters: Your router sits between every device and the internet. Default passwords and old firmware make it an easy target.

How to do it:

• Turn on WPA3 or WPA2 encryption, as the FTC recommends, preferring WPA3 where supported.
• Change the router’s default admin username and password, turn off remote management and log out of the admin panel afterward.
• Update router firmware, and replace routers the manufacturer no longer supports.
• Put visitors and smart devices on a separate guest network.
• Ask remote staff to secure home routers too, and to use a phone hotspot or company VPN instead of public Wi-Fi for sensitive work.

9. Review Vendor and SaaS Security

Why it matters: Your data increasingly lives in other companies’ software, so a weak vendor can expose you as surely as your own mistakes.

How to do it:

• Inventory every tool holding sensitive data, each with a named owner.
• Ask before you buy: Can we enforce MFA or single sign-on? Is there independent security documentation, such as a SOC 2 report or ISO/IEC 27001 certification? How do we export and delete our data? How will you notify us of a breach?
• Follow the FTC’s vendor advice: put security in contracts, limit vendor access to what’s needed for only as long as needed, and verify compliance.
• Audit connected apps with access to your Google or Microsoft accounts, especially AI tools that request email and documents. Our guide to AI automation for small businesses covers connecting them safely.

10. Write a One-Page Incident Response Plan

Why it matters: The first hour of an incident is chaotic. A written plan means you call the right people, preserve evidence and don’t wipe a device too early. CISA recommends maintaining a plan and exercising it regularly.

How to do it: Keep one page, plus a printed copy in case systems are down. Include:

1. Who’s in charge: a lead and a backup.
2. Who to call: IT provider, bank, cyber insurer, lawyer and key vendors, with phone numbers.
3. First steps: disconnect affected devices from the network without wiping them, change passwords from a clean device and call the bank if money moved.
4. Evidence: save emails, screenshots, logs and a timeline.
5. Reporting: file with the FBI’s Internet Crime Complaint Center (IC3), which says reports can sometimes help freeze stolen funds. The FTC also suggests notifying your local FBI office.
6. Notification: ask a lawyer whether breach-notification laws or contracts require notice, and check whether your insurer must be contacted first.

Once a year, run a 30-minute tabletop exercise (“the bookkeeper’s email is sending fake invoices”) and fix the gaps.

Printable Small Business Cybersecurity Checklist

Print this and review it quarterly. In a tiny business, the “IT lead” may be the founder or an outside provider.

Control	Owner	How often
MFA enforced; passkeys or keys for admins, email, banking	IT lead	Once; review quarterly
Password manager and shared vaults	IT lead	At onboarding; quarterly
Automatic updates on devices, apps, router, website	IT lead, all staff	Automatic; verify monthly
3-2-1 backups with a protected copy	IT lead	Daily; test restore quarterly
Encryption, screen lock, remote wipe	IT lead	At setup; check quarterly
SPF/DKIM/DMARC, call-back rule, phishing refreshers	Email admin, finance lead	Rule every time; training quarterly
Access review and same-day offboarding	Founder or manager	Quarterly; every departure
Router secured, guest network on	Office manager	Once; firmware monthly
Vendor and connected-app review	Tool owner	Before purchase; annually
Incident response plan and tabletop	Founder	Annually

Frequently Asked Questions

What should a small business do first?

Turn on MFA for email, admin, banking and payroll, roll out a password manager and switch on automatic updates. These small business security basics take days and close the easiest gaps. Backups come next.

Can we handle cybersecurity without an IT department?

Yes. A founder or office manager can run every item here with settings in existing tools. As you grow, a managed IT provider can take over routine work, but keep ownership of your admin accounts and domain.

Is cyber insurance worth it?

It can be, if downtime would strain your cash flow. The FTC’s guidance explains first-party coverage (your own losses) versus third-party coverage (claims against you). Insurers may ask about MFA and backups, so this checklist helps there too.

What if someone clicks a phishing link?

Thank them for reporting it. Change the password from a clean device, sign out all sessions, check for new email-forwarding rules and scan the device. If money moved, call the bank immediately.

Next Steps: Put the Essentials in Place This Month

Cybersecurity for small business isn’t a product you buy; it’s a short list of habits you set up once and review on a schedule. Follow the four-week plan, print the checklist and book a quarterly review. For more free guidance, the NIST Small Business Cybersecurity Corner collects quick-start guides from government and nonprofit sources.

Explore our Cybersecurity hub and Tools & Software hub, or browse everything on GrandPeoples.com. Our editorial policy explains how we research guides like this. Want a security topic covered? Contact us.