A Cybersecurity Checklist for Small Businesses Without IT Staff

Small businesses handle real money and real customer data, yet rarely have anyone whose job is security. Attackers know this, and most of their tools are automated: they scan for weak passwords, unpatched software and careless payment processes without caring how big the company is.

The encouraging part is that a short list of basic steps blocks the most common attacks. You do not need a big budget or a technical background, just a list and a little time each month. This checklist is ordered by impact, so start at the top and work down.

This week: protect the accounts that unlock everything

These steps cover the logins that can reset or reach everything else.

• Turn on two-factor authentication for business email, banking, payment processing, payroll, your domain registrar and website hosting. Our comparison of two-factor authentication methods explains which options to choose.
• Use a password manager so every account has a unique password. If you are deciding, read how to choose a password manager.
• List who has administrator access to email, the website, social media pages and financial accounts. Remove anyone who no longer needs it, including past contractors.
• Check recovery details. The backup email and phone number on critical accounts should belong to the business, not to a former employee or a personal address nobody monitors.

This month: secure devices and data

• Turn on automatic updates for operating systems, browsers and apps on every work device. Our guide to keeping software updated shows how to do this without disrupting the day.
• Encrypt laptops. Windows offers BitLocker or Device Encryption depending on edition and hardware, and Macs offer FileVault. Encryption means a stolen laptop does not become a stolen customer list.
• Require a screen lock on every computer and phone that touches business data.
• Keep the built-in protection on. Windows includes Microsoft Defender and macOS includes its own malware protections. Make sure nobody has switched them off.
• Secure the office Wi-Fi and give customers a separate guest network. Follow our steps to secure a Wi-Fi router.
• Back up important files automatically, with at least one copy stored somewhere separate from the office, and try restoring a file to prove it works.

This quarter: people and process

Technology covers part of the risk. Habits cover the rest.

• Talk about phishing for fifteen minutes. Show your team what a suspicious email looks like and make it normal to ask, "Is this real?" before clicking or paying.
• Verify every change to payment details by phone, using a number you already have on file, never one from the email requesting the change. Invoice fraud often arrives as a polite note that a vendor "changed banks."
• Give each person their own account. Shared logins make it impossible to know who did what and hard to remove access when someone leaves.
• Write a short offboarding checklist so departing staff lose access to email, files, financial tools and social accounts on their last day.
• Review connected apps. Email and cloud storage accounts often have third-party apps with access granted years ago. Remove the ones you no longer use.
• Never store full card numbers. Use your payment processor's hosted checkout or payment forms so card data does not pass through your own systems.

Write a one-page incident plan

When something goes wrong, people panic and lose time. A single page written in advance helps.

1. Who to call. List your bank's fraud line, whoever helps with your technology, your insurance agent and an attorney. Keep this list on paper too.
2. Contain first. Disconnect an affected computer from the network, but do not wipe it yet. Evidence can matter.
3. Change passwords from a clean device, starting with email and financial accounts.
4. Call the bank immediately if money was sent to a fraudster. Speed can make recovery possible.
5. Report it. In the United States, internet crime can be reported to the FBI's Internet Crime Complaint Center. If customer data may be involved, notification laws can apply, so talk with an attorney about your obligations.
6. Check your insurance. Some business policies include cyber coverage with a hotline that can connect you to help.

Free help worth knowing about

The U.S. Cybersecurity and Infrastructure Security Agency publishes free guidance and resources for small organizations at cisa.gov. Reading even one of their short guides with your team is a good use of a lunch hour.

If you want help thinking through your own setup, contact us and tell us where you are starting from.

Frequently asked questions

Do criminals really target small businesses?

Yes. Many attacks are automated and look for any weak password or unpatched system, regardless of company size. Small businesses are also targeted directly with fake invoices and payment change requests.

Do we need to buy antivirus software?

Start with the protection built into your operating system, kept on and updated. Additional tools can help, but they do not replace two-factor authentication, updates, backups and careful payment habits.

How often should we review this checklist?

Do the account and device steps once, then review access, backups and connected apps every quarter. Also review whenever someone joins or leaves the team.