Small Business IT Security Checklist

Accounts & MFA

• Turn on multi-factor authentication for emailEvery Microsoft 365 or Google Workspace account, no exceptions.
• Protect admin accounts separatelyUse dedicated admin logins with MFA, not everyday accounts.
• Use a company password managerUnique passwords for every system, shared securely instead of by sticky note or spreadsheet.
• Remove access on the last dayDisable accounts and change shared passwords the day someone leaves.

Devices

• Install updates automaticallyWindows, macOS, browsers, and apps like Adobe and Zoom, at least monthly.
• Run business-grade endpoint protectionEDR that detects ransomware behavior, not just known viruses.
• Encrypt laptopsBitLocker or FileVault, so a lost laptop is not a data breach.
• Replace unsupported systemsAnything no longer receiving security updates goes on the replacement list.

Backups

• Follow the 3-2-1 ruleThree copies of important data, on two kinds of storage, with one offsite.
• Keep a copy ransomware cannot touchImmutable or offline backups that compromised accounts cannot delete.
• Back up Microsoft 365 or Google WorkspaceCloud providers do not keep deleted mail and files forever.
• Test a restore every quarterA backup you have never restored is only a hope.

Email

• Use advanced email filteringBlock phishing, impersonation, and malicious attachments before they reach inboxes.
• Set up SPF, DKIM, and DMARCMakes it much harder for criminals to send email that looks like it came from you.
• Verify payment changes by phoneAny request to change bank details or wire money gets a call to a known number.

Network

• Use a business firewallKept updated, with remote management closed to the internet.
• Separate guest Wi-FiVisitors and personal devices never share the network with company computers.
• Change default passwordsOn routers, printers, cameras, and anything else plugged into the network.

People & Training

• Train staff to spot phishingShort, regular training plus simulated phishing emails.
• Make reporting easy and blame-freePeople should know exactly who to call when something looks wrong, and feel safe calling.

Incident Plan

• Write down who to callIT provider, cyber-insurance carrier, bank, and legal contacts, printed and stored offline.
• Know your first stepsDisconnect affected devices, do not pay or reply, call IT, and preserve evidence.