Cybersecurity Checklist for Small Businesses: 15 Steps to Protect Your Company

Most attacks on small businesses are not clever. They succeed because a password was reused, an update was skipped, a staff member clicked a convincing link, or there was no backup when something went wrong. That is good news: it means a short list of basic habits blocks most of the risk.

This checklist is written for business owners and managers, not IT specialists. Work through it one section at a time, and tick off what you have done.

Accounts and passwords

1. Turn on two-step verification everywhere it is offered

Two-step verification (also called multi-factor authentication, or MFA) asks for a second proof, such as a code from an app, after your password. Even if a criminal steals the password, they cannot get in without it. Turn it on first for email, then banking, social media pages, your website and your domain registrar. Prefer an authenticator app over SMS codes where possible.

2. Use a password manager

Nobody can remember dozens of strong, different passwords. A password manager stores them securely and fills them in for you, so every account can have a long, unique password. If one service is breached, the others stay safe.

3. Give everyone their own account

Shared logins make it impossible to know who did what, or to remove one person's access without changing everyone's password. Each staff member should have their own email and their own login for business systems, with only the access they need.

4. Remove access the day someone leaves

Keep a simple list of every account each person has. When they leave, disable their accounts, change any shared passwords they knew, and transfer ownership of their files and email to the business.

Devices and software

5. Keep everything updated

Updates close security holes that criminals already know about. Turn on automatic updates for Windows, macOS, phones, browsers and the software you use. Replace devices that no longer receive security updates.

6. Use reputable security software from official sources

Windows includes Microsoft Defender, which is switched on by default; keep it enabled and updated. If you prefer another antivirus product, buy it from the vendor or an authorised reseller. Never use "free licence keys" shared online, cracked software or activation tools: they are a common way malware gets onto business computers, and they leave you without updates or support.

7. Lock and encrypt devices

Every laptop and phone should have a screen lock with a PIN or password, and lock automatically after a few minutes. Turn on device encryption (BitLocker or Device Encryption on Windows, FileVault on Mac; modern phones encrypt when a screen lock is set), so a stolen device does not mean stolen data.

8. Only install software you need, from official stores and websites

Every extra program is something else to update and a possible way in. Install software from official app stores or the vendor's own website, and remove programs nobody uses.

Data

9. Back up automatically, and test it

Backups protect you against theft, hardware failure, accidental deletion and ransomware. Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy kept off-site or in the cloud. Keep at least one backup that is not permanently connected to your computers, so ransomware cannot encrypt it too. Then test: restore a few files every few months.

10. Know where your important data lives

Customer lists, invoices, accounts and contracts should live in an organised, backed-up place with controlled access, not scattered across personal laptops and flash drives.

Email, WhatsApp and payment scams

11. Teach everyone to spot phishing

Phishing messages pretend to be from a bank, a supplier, a delivery company or even your own manager, and push you to click a link, open an attachment or log in. Warning signs include urgency ("your account will be closed today"), unexpected attachments, slightly wrong sender addresses or web addresses, and requests for passwords or codes. When in doubt, contact the sender through a number or address you already know, not the one in the message.

12. Verify every change in payment details

A common and costly scam is a message, apparently from a supplier, saying their bank or Mobile Money details have changed. Always confirm changes by calling the supplier on a number you already have, before paying. The same applies to urgent payment requests that seem to come from the business owner.

13. Never share verification codes

No genuine bank, mobile operator or WhatsApp support will ask you for a one-time code. Anyone who asks for one is trying to take over an account. Turn on two-step verification in WhatsApp too, under Settings → Account.

Network

14. Secure your Wi-Fi and router

Change the router's default admin password, use WPA2 or WPA3 encryption with a strong Wi-Fi password, and keep the router's firmware updated. Give visitors a separate guest network so they never share the network your business computers use.

When something goes wrong

15. Have a one-page incident plan

Decide in advance what to do if a computer is infected, an account is hacked or a device is stolen:

1. Disconnect the affected device from the network and Wi-Fi.
2. Change passwords for affected accounts from a clean device, and sign out of all sessions.
3. Call your bank immediately if payment details or banking access may be involved.
4. Contact your IT support provider.
5. Restore from backup once the device has been cleaned or reinstalled.
6. Tell customers or partners if their information may have been exposed.

Write down the phone numbers you would need, such as your bank, IT support and internet provider, somewhere you can reach without your computer.

The checklist at a glance

• Two-step verification on email, banking and social media
• Password manager and unique passwords
• One account per person; access removed when people leave
• Automatic updates on all devices
• Built-in or licensed security software, never cracked keys
• Screen locks and encryption on laptops and phones
• Automatic, tested 3-2-1 backups
• Staff trained to spot phishing and fake payment requests
• Secured router and a separate guest Wi-Fi
• A written incident plan

Getting help

You can complete most of this checklist yourself in a few afternoons. If you would rather have it set up and monitored for you, our IT support service covers security, backups, Microsoft 365 and device management for small businesses. Read more about what reliable IT support should cover, or contact us for a free review.