Small business security checklist

Identity & access

• 01Multi-factor authentication (MFA) is enforced for every user, especially email and admin accounts.
• 02Admin accounts are separate from everyday accounts and limited to the people who need them.
• 03Accounts of departed employees are disabled the same day they leave.
• 04Staff use a password manager instead of reusing passwords.

Email security

• 05SPF, DKIM, and DMARC are configured for your domain, and DMARC is not set to “none”.
• 06Staff know how to report a suspicious email, and someone acts on reports.
• 07Wire transfers and payment changes are verified by phone, never by email alone.
• 08External emails are tagged so staff can recognize them.

Devices

• 09Every laptop and phone used for work has disk encryption turned on.
• 10Operating systems and apps install security updates automatically.
• 11Endpoint protection (EDR or antivirus) runs on every company device.
• 12Lost or stolen devices can be locked or wiped remotely.

Backups & recovery

• 13Critical data is backed up automatically, with at least one copy offline or immutable.
• 14A restore from backup has been tested in the last six months.
• 15You know how long the business can operate if your main systems go down.
• 16There is a written plan for who to call and what to do during a cyber incident.

Vendors & governance

• 17You keep a list of the vendors and cloud services that hold your data.
• 18Key vendors have been asked about their security and breach notification.
• 19Someone in the organization is clearly responsible for cybersecurity decisions.
• 20Staff receive security awareness training at least once a year.