A practical cybersecurity checklist for small businesses

1. Protect every important account

Require multifactor authentication for email, Microsoft 365, remote access, financial systems, password managers, and administrative accounts. Strong MFA makes a stolen password much less useful to an attacker.

Use unique passwords and a business password manager rather than storing credentials in browsers, spreadsheets, notes, or shared messages. Administrative accounts should be separate from everyday user accounts whenever practical.

• Enable MFA for employees, owners, administrators, and outside vendors.
• Disable unused accounts promptly.
• Review sign-in alerts and risky authentication activity.

2. Keep computers and applications current

Operating systems, browsers, business applications, network devices, and security software all need timely updates. Attackers regularly use known weaknesses for which fixes already exist.

Use centralized patching where possible, define how urgent updates are handled, and confirm that laptops used outside the office are included. Replace systems that no longer receive security updates instead of treating them as permanent exceptions.

3. Reduce email and phishing risk

Email remains a common path into a business because it reaches every employee. Combine technical protections with short, relevant employee training. People should know how to report an unusual payment request, a suspicious login page, or a message that appears to come from an executive or vendor.

Create a verification rule for sensitive requests. Changes to banking details, gift-card purchases, password resets, and confidential file requests should be confirmed through a known second channel—not by replying to the same message.

4. Give people only the access they need

Access should match a person’s role. Review shared folders, mailboxes, cloud applications, and administrative permissions instead of allowing access to accumulate over time.

Use a written onboarding and offboarding process. When an employee or vendor leaves, remove access, recover business devices, preserve necessary records, and transfer ownership of important files or accounts without delay.

5. Back up critical information—and test recovery

Identify the data and systems the business cannot operate without. Keep protected copies according to an agreed recovery plan, and limit the ability of a compromised everyday account to alter or delete those copies.

A successful backup notification is useful, but a test restore provides stronger evidence. Document who requests a restore, who approves it, and how long recovery actually takes.

6. Know your devices, vendors, and remote access

• Maintain an inventory of computers, network equipment, cloud services, and business owners.
• Remove software and remote-access tools that are no longer needed.
• Require secure access for remote employees and outside support providers.
• Ask critical vendors how they protect access to your systems and notify you of incidents.

7. Prepare for the first hour of an incident

Write down who employees should contact if they click a suspicious link, lose a device, see an unexpected MFA prompt, or notice unusual account activity. Fast reporting can limit damage, and employees should not fear blame for raising a concern.

Keep key contact details, insurance information, vendor contacts, and decision responsibilities somewhere available even if normal email or cloud access is disrupted. Practice a short scenario so leadership understands what it will need to decide under pressure.