The Small Business Cybersecurity Checklist: 20 Steps That Actually Matter
Small businesses are frequent targets because they often have weaker defences. This practical 20-step checklist covers the security basics that prevent most real-world attacks.
Many small business owners assume attackers are only interested in large companies. In reality, smaller organisations are often attractive targets precisely because they tend to have fewer defences. Most attacks are not sophisticated: they rely on stolen passwords, unpatched software, convincing fake emails and missing backups.
The good news is that a handful of well-understood measures prevent the majority of common attacks. You do not need an enterprise security budget. You need consistency. Work through this checklist, mark each item done, and revisit it every few months.
Accounts and passwords
1. Turn on multi-factor authentication (MFA) everywhere it matters
MFA requires a second proof of identity, such as a code from an app, in addition to a password. Enable it first on email, cloud storage, banking, accounting software, domain registrar, website admin and any remote-access tools. Email comes first because access to email allows attackers to reset most other passwords.
2. Use a password manager
A password manager generates and stores long, unique passwords for every account. It removes the temptation to reuse passwords, which is how one leaked password becomes many compromised accounts. Business password managers also let you share credentials safely with staff and revoke access when someone leaves.
3. Give everyone their own account
Shared logins make it impossible to know who did what and difficult to remove access. Each staff member and each contractor should have an individual account.
4. Apply least privilege
Most people do not need administrator rights. Give staff the access their role requires and nothing more. Keep a short list of who holds admin access to critical systems, and review it every quarter.
5. Remove access promptly
When an employee or freelancer leaves, disable their accounts on the same day, change any shared passwords they knew and collect company devices.
Devices and software
6. Keep everything updated
Enable automatic updates for operating systems, browsers and common applications. Many attacks exploit known vulnerabilities for which fixes already exist. Do not forget routers, firewalls, printers and website plugins.
7. Replace unsupported systems
Devices and software that no longer receive security updates should be replaced or isolated. An old computer running an unsupported operating system is a permanent open door.
8. Use endpoint protection
Built-in protections such as Microsoft Defender are effective when kept enabled and updated. Larger teams may benefit from centrally managed endpoint protection that alerts an administrator to threats.
9. Encrypt laptops and phones
Turn on full-disk encryption (BitLocker on Windows, FileVault on macOS, default encryption on modern phones). If a device is lost or stolen, the data stays protected.
10. Lock screens automatically
Set devices to lock after a few minutes of inactivity and require a PIN, password or biometric to unlock.
Email and people
11. Train staff to recognise phishing
Phishing emails imitate banks, suppliers, delivery companies or even colleagues. Teach staff to check sender addresses, hover over links before clicking, be suspicious of urgency and never enter passwords after clicking an email link. Short, regular reminders work better than a single long session.
12. Verify payment change requests by phone
A common fraud involves an email, apparently from a supplier, asking you to pay to a new bank account. Always confirm such requests by calling a known phone number, not one provided in the email.
13. Set up email authentication
Ask your IT professional to configure SPF, DKIM and DMARC records for your domain. These make it harder for criminals to send emails that appear to come from your business.
Network and Wi-Fi
14. Secure your router and Wi-Fi
Change default admin passwords, keep router firmware updated, use WPA2 or WPA3 encryption and disable features you do not use, such as WPS and remote administration.
15. Separate guest Wi-Fi
Visitors and personal devices should use a separate guest network that cannot reach your business computers, printers or servers.
16. Use a firewall
Most business routers include a basic firewall. For offices with servers, CCTV systems or many devices, a dedicated business firewall provides better control and visibility.
Data and recovery
17. Follow the 3-2-1 backup rule
Keep three copies of important data, on two different types of storage, with one copy off-site or in the cloud. Make sure at least one backup cannot be modified or deleted from your normal network, which protects against ransomware.
18. Test restoring backups
A backup you have never restored is a hope, not a plan. Every few months, restore a few files or a full system to confirm backups work and to learn how long recovery takes.
19. Know where your sensitive data lives
List the places customer data, financial records and employee information are stored. You cannot protect what you do not know you have, and many data protection laws expect you to know.
Planning
20. Write a simple incident response plan
When something goes wrong, panic costs time. A one-page plan should answer:
- Who do we call first (internal contact and IT professional)?
- How do we disconnect affected devices from the network?
- Where are backups, and who can restore them?
- Who needs to be informed (customers, bank, authorities)?
- Where are important phone numbers stored offline?
Print it and keep it somewhere everyone can find it.
A quick priority guide
If you can only do a few things this month, start here:
| Priority | Action | Why |
|---|---|---|
| 1 | MFA on email and key accounts | Stops most account takeovers |
| 2 | Automatic updates | Closes known vulnerabilities |
| 3 | Tested, off-site backups | Recovers from ransomware and mistakes |
| 4 | Password manager | Ends password reuse |
| 5 | Phishing awareness | People are the first line of defence |
When to bring in a professional
Some steps need technical help: configuring firewalls, setting up email authentication records, designing backups, reviewing cloud permissions or responding to an incident. A one-time security review by an experienced professional often identifies the highest-risk issues quickly and gives you a prioritised list of fixes.
On Dreqto you can find cybersecurity and network security professionals by skill and city, for remote reviews or on-site work. Browse profiles freely and send a connection request when you find the right person. Contact details stay private until they accept.
Frequently asked questions
We are a very small business. Are we really a target?
Yes. Most attacks are automated and opportunistic: criminals scan for weak passwords, unpatched systems and unprotected email accounts regardless of company size. Small businesses are often affected precisely because basic protections are missing.
What should we do first if we suspect an attack?
Disconnect affected devices from the network (but do not switch them off if you can avoid it), contact your IT professional, change passwords from a clean device and follow your incident response plan. Do not pay ransoms without professional and legal advice.
How often should we review security?
Review this checklist at least every quarter, and whenever you add new systems, change providers or have staff changes. An annual review by an experienced security professional is a sensible addition for businesses handling sensitive data.
Summary
Security for small businesses is not about expensive tools. It is about doing the basics consistently: strong authentication, updates, backups, careful email habits and a plan for when things go wrong. Work through these twenty steps, and your business will be a much harder target than most.
