Checklist
A Practical Cybersecurity Checklist for Small Businesses
A prioritized baseline for protecting accounts, devices, data, and day-to-day operations without building an enterprise-sized security program.
Small businesses do not need dozens of disconnected security products. They need a dependable baseline that protects the systems they rely on, limits common attack paths, and makes recovery possible when something goes wrong. Use this checklist to identify the highest-value improvements first.
Protect identities and access
Compromised credentials remain one of the most common ways attackers enter an environment. Start by reducing the value of a stolen password.
- Require multi-factor authentication for email, remote access, cloud administration, and financial systems.
- Give every user an individual account and remove shared administrator credentials.
- Review privileged access quarterly and immediately disable accounts when staff leave.
- Use a business password manager to create and securely share unique credentials.
Maintain systems and endpoints
Consistent maintenance closes known vulnerabilities and makes suspicious activity easier to identify.
- Apply operating system, browser, firewall, and business-application updates on a defined schedule.
- Use centrally managed endpoint protection on every supported workstation and server.
- Encrypt laptops and other portable devices that store or access business information.
- Replace unsupported hardware and software that no longer receives security updates.
Prepare to recover
Prevention matters, but a tested recovery capability keeps a security event from becoming a business-ending interruption.
- Maintain encrypted backups with at least one protected or offline copy.
- Test restoration of representative files and systems instead of relying only on successful backup notifications.
- Document who makes technical, legal, insurance, and customer-communication decisions during an incident.
- Keep critical vendor and response contacts somewhere accessible when normal systems are unavailable.