Skip to content

Practical security for real people & small teams

Small Business Cybersecurity Checklist: 15 Things to Do This Month

By , ICT engineer Published

Guide type
Checklist
Risk if skipped
High
Time
1–2 days over a month
Cost
Mostly free
For
Teams of 1–50, no IT staff
Last verified
2026-10-04

The short answer

If you only do five things, do these, in this order:

  1. Turn on multi-factor authentication for email and every admin account.
  2. Give the team a password manager and stop sharing logins.
  3. Set up backups with one copy that ransomware cannot reach, and test a restore.
  4. Make software updates automatic on every device.
  5. Adopt a rule that any change of bank details is confirmed by phone, on a number you already had.

These cover the attacks that hit small businesses most: stolen email accounts, payment fraud and ransomware.

Most small businesses are not attacked because someone chose them. They are attacked because an automated campaign found a reused password, an unpatched device or an inbox without a second login step. That is good news: the basics close most of those doors, and most of the basics are free.

This checklist spreads the work over four weeks so it fits around running a business. Use the Mark as done buttons to track progress; it is saved on this device.

The 15 items at a glance

#ItemTimeCost
1MFA on email and admin accounts1–2 hFree
2Separate admin accounts30 minUsually free
3Team password manager2 hLow monthly fee
4Same-day offboarding30 minFree
5Payment verification rule30 minFree
6SPF, DKIM and DMARC on your domain1 hFree
7Built-in security settings in Microsoft 365 or Google Workspace1 hIncluded
8Automatic updates everywhere1 hFree
9Disk encryption30 minFree
10Screen locks and lost-device plan30 minFree
113-2-1 backups with a tested restore2–3 hLow
12Router and Wi-Fi basics45 minFree
1315-minute phishing talk15 minFree
14One-page incident plan1 hFree
15Account and domain inventory1 hFree

Week 1: Accounts

  1. Turn on multi-factor authentication, starting with email

    Email is the master key: it resets every other password. Turn on MFA for every mailbox first, then banking, accounting, payroll, your domain registrar and social media. For admin accounts, CISA recommends phishing-resistant MFA such as passkeys or hardware security keys. Our passkey setup guide walks through Google and Microsoft accounts.

  2. Use separate admin accounts

    Whoever manages Microsoft 365, Google Workspace or the website should have a separate admin login that is not used for daily email and browsing. If a phishing email gets the everyday account, it does not get the keys to everything.

  3. Give the team a password manager

    Shared spreadsheets of passwords and one login for five people are how small businesses lose control of accounts. A business password manager lets you share access without sharing the password itself, and lets you remove someone's access in one click. While you move the team's passwords into it, our free password leak checker shows whether any of them already appear in known data breaches, without sending the password anywhere.

  4. Write a same-day offboarding list

    When someone leaves, on their last day: disable their accounts, transfer their files, remove them from shared vaults and change any password they knew. Write the list once, then follow it every time.

Week 2: Email and money

  1. Adopt a payment verification rule

    Business email compromise, where a criminal pretends to be your boss or a supplier and redirects a payment, is one of the costliest frauds the FBI tracks. The fix is a written rule: any new or changed bank details are confirmed by calling a phone number you already had on file, and payments above a set amount need a second person's approval. AI voice cloning makes this even more important; see our guide to voice clone scams.

  2. Set up SPF, DKIM and DMARC on your domain

    These three DNS records prove which servers may send email as your domain, and tell other providers what to do with fakes. Google and Yahoo began requiring them from bulk senders in 2024, and Microsoft followed for Outlook.com in 2025. Even if you are not a bulk sender, DMARC makes it much harder for criminals to send invoices that appear to come from you. Google's sender guidelines are a good reference, and our SPF, DKIM and DMARC guide has a free checker and record generator.

  3. Switch on the security your email platform already includes

    Microsoft 365 includes security defaults, which enforce MFA and block legacy sign-in methods at no extra cost. Google Workspace lets admins enforce 2-step verification for everyone. Both have alerts for suspicious sign-ins: make sure they go to an inbox someone reads.

Week 3: Devices and data

  1. Make updates automatic

    Turn on automatic updates for Windows, macOS, iOS, Android, browsers and the apps you rely on. Do not forget the router and any network storage device: they need firmware updates too. Replace devices that no longer receive security updates.

  2. Turn on disk encryption

    BitLocker on Windows and FileVault on Mac protect data if a laptop is lost or stolen. Modern iPhones and Android phones encrypt storage when a screen lock is set.

  3. Require screen locks and plan for lost devices

    Every laptop and phone that touches business data needs a screen lock. Make sure location and remote-wipe features are switched on and that someone knows how to use them on a Friday evening.

  4. Set up 3-2-1 backups and test a restore

    Keep three copies of important data, on two kinds of storage, with one copy offline or immutable so ransomware cannot encrypt it. Then do the step most businesses skip: restore a real file from backup and check it opens. CISA's StopRansomware page explains why the offline copy matters.

  5. Fix the router and Wi-Fi basics

    Change the router's default admin password, use WPA3 (or WPA2 if that is all you have), turn off remote administration unless you need it, and put customers and smart devices on a separate guest network.

Week 4: People and plan

  1. Hold a 15-minute phishing talk

    Show the team two or three real phishing messages, ideally ones your business received. Explain one rule: if something asks for money, a password or a code, verify it another way. Make reporting easy and never punish someone for clicking; the business only gets hurt when people hide it. Include phones too: fake "unpaid toll" and delivery texts are a good real example of the same tricks arriving by SMS.

  2. Write a one-page incident plan

    Who do you call first, and how, if email is down? List your bank's fraud line, your IT provider, your cyber insurer if you have one, where backups live, and a way to reach staff that does not depend on company email. Our phishing response guide is a good first page.

  3. Keep an inventory of accounts and domains

    List every service the business uses, who has admin access, and when your domain names renew. Make sure the domain registrar account uses a company email address and MFA. Losing a domain because it expired on a former employee's card is more common than it should be.

Don't

  • Don't buy expensive security products before the free basics above are done.
  • Don't share one login between several people.
  • Don't keep your only backup on a drive that is always connected to the computer it protects.
  • Don't let "it's urgent" override the payment verification rule, even when the request seems to come from the owner.

Free resources worth bookmarking

How we checked this

Written by Ariel, ICT engineer. On 2026-10-04 we checked each item against guidance from the FTC, CISA and the UK's National Cyber Security Centre, and against Microsoft's and Google's documentation for their business email platforms. Exact menus differ by plan and change over time; follow the linked vendor pages for current steps. No products were tested for this checklist and it contains no affiliate links.

Sources