Small Business Cybersecurity Checklist: Ranked by How Much Risk Each Item Removes

Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.

A former employee's login still works eight months after they left. Nobody was careless and nobody made a bad decision — the person who handled accounts was busy, the offboarding was a conversation rather than a checklist, and the account was simply never switched off. It is now the cleanest way into the network that anyone has. No exploit required.

Almost every small business incident I have looked at came in through something on this list, and usually through an item that felt too boring to prioritise. So this is not a comprehensive 40-point audit. It is nine controls, ordered by how much risk each one removes per hour you spend on it. Items near the top are not more glamorous. They are just the ones that close the doors people actually walk through.

Editor's Take

Ranking by risk removed is the right instinct, because a checklist nobody finishes is decoration. The top of the list is almost always access hygiene: old accounts that still work, shared logins, and MFA missing on the mail system. Those are unglamorous and cheap, and they are what the common attacks actually need.

1. Multi-factor authentication on email, then on everything reachable from outside

Email first, and the reason is not that mail contains secrets. It is that the mailbox is the reset button for everything else. Whoever holds it can request a password reset on your bank, your payroll system, your accounting package, your cloud storage and your domain registrar, and the reset link lands in the inbox they already control. Protecting email protects the recovery path of your entire business.

Two details that decide how much this is worth. Prefer an authenticator app or a hardware key over text messages, since a code sent by SMS can be redirected by someone who convinces a carrier they are you. And cover remote access and any admin console, not just mail — an unprotected VPN or remote desktop login is a front door with no lock on it at all. Our two-factor guide covers which method to pick.

MFA is not magic. Real-time proxy pages can relay a code as you type it, which is what the BigBear MFA bypass operation was built on. It is still the single highest-value control on this page.

2. Fix the recovery path, not just the login

This is the item that gets skipped after item one, and it quietly undoes it. A strong second factor on an account whose password can be reset through a shared inbox or a phone number nobody has updated in three years is a strong lock on a door with a window beside it.

Go through your critical accounts and ask where a reset goes. If the answer is an email address that is not itself protected, or a personal mobile number belonging to someone who left, close that. Use passwords that are long, unique and stored in a shared business password manager rather than in a spreadsheet, a browser, or someone's memory.

3. A backup you have actually restored from

Backups rank this high because they are the only item on the list that ends an incident rather than preventing one. Every other control is a gate; this one is the undo button, and it is the one most small businesses believe they have.

Three conditions, and all three matter:

• At least one copy the attacker cannot reach. If your backup is on a drive permanently attached to the same machine, or in a cloud account the same credentials open, it is part of the blast radius. Something offline, immutable, or under separate credentials.
• A restore you have performed. An untested backup is an assumption. Once a quarter, pick one important file, restore it end to end, and time it. That duration is your actual recovery time, and it is usually longer than people expect.
• Coverage of what would stop you trading. Not just documents: the customer database, the accounts, the configuration of anything bespoke, and the export of any software you cannot reinstall from memory.

Our backup software comparison covers the options, and the ransomware protection guide puts this in order relative to prevention.

4. Patch with a deadline, internet-facing first

You will not patch everything, so stop trying to and start triaging. The split that matters is reachability.

Anything a stranger on the internet can connect to goes to the front of the queue: remote access gateways, VPN appliances, web servers, and whatever content management system runs your website. Those are scanned continuously by automated tooling that does not care how small you are. Software that only runs on a workstation inside the office can wait a week.

The mechanism is more important than the intention. Pick a cadence you can actually hold — monthly for exposed systems, quarterly for everything else — and write down who does it. "We patch when there's something important" reliably becomes never, because nothing announces itself as important.

5. Remove local administrator rights from workstations

This one sounds like IT hygiene and is closer to a structural control, which is why it sits above items people find more interesting.

A staff member with administrator rights on their own machine can install anything, and so can anything that runs as them. Without those rights, most malicious code is confined to that user's profile. With them, one clicked link becomes a foothold with the ability to disable security software, reach network shares, and move sideways.

The pushback is always that people need to install software. Handle it with an approved list or a "ask and we'll install it" process rather than by leaving every workstation permanently unlocked. It is a one-week adjustment and it removes an enormous amount of your exposure.

6. Offboarding as a written checklist, not a conversation

Back to the opening. Stale accounts are dangerous in a way that feels disproportionate, because they combine three things: they usually still work, nobody is watching their activity, and the person who would notice something odd no longer works there.

Write the list once and run it every time. Disable the account on the last working day, then go system by system rather than assuming one identity provider covers them all: email, the identity provider itself, remote access and VPN, file storage and shared drives, chat, the customer database, the payment and invoicing tools, and any third-party app someone signed up for with a work address.

Then two steps people miss: collect physical keys, door fobs and hardware security keys, and check the mailbox for forwarding rules before you convert it. A rule quietly copying mail to an external address survives the account being closed in your head, and it is the single most common thing found after the fact.

7. Vendor and third-party access, with an end date

Most small businesses now hand some part of their operation to somebody else — a bookkeeper, an IT contractor, a fulfilment company, a marketing agency — and that access rarely gets reviewed or removed.

Three rules. Give each vendor their own named account rather than a shared one, so you can see what they did and switch them off without disrupting anyone else. Grant the narrowest access that lets them do the job, and revisit it when the job changes. And put a review date on it — when the contract ends, the account goes, and you ask for confirmation that your data was deleted rather than assuming it.

That last sentence is not pedantry. The Trezor and ShipMonk breach is what it looks like when a vendor relationship ends and the records do not: years-old customer data sitting in a reachable system, with written assurance it had been deleted. The Veradigm breach is the same shape in healthcare. Your exposure is your vendors' exposure, and asking for proof is cheaper than explaining it later.

8. Stop your own domain being used against you

SPF, DKIM and DMARC are DNS records that tell the world which servers may send mail as your domain. Without them, anyone can send an email that appears to come from your company — to your customers, your suppliers, and your staff.

This is cheap, takes an afternoon, and is unusual in that it primarily protects other people. It also protects you from the aftermath: the customer who received a fake invoice from your domain blames you, not the person who sent it. Your DNS or email provider has a setup guide, and DMARC reporting will show you who is already doing it.

Pair it with one internal rule that costs nothing: any change to bank details or a new supplier payment gets confirmed by voice with a number you already had. Not by replying to the email. That single control defeats most invoice fraud regardless of how convincing the message is, and our phishing identification guide is the right thing to hand to staff alongside it.

9. Write down who to call

Last, and genuinely important. In the hour where something is happening, nobody should be deciding who the IT contractor is or whether the cyber insurance policy has a hotline.

One page, printed as well as stored: your IT support contact, your insurance provider and policy number, whoever handles your legal obligations if you hold personal data, and the two or three people who can authorise spending money. Then note the first three actions — disconnect the affected machines, do not power anything off before you have spoken to someone, and do not pay anything before you have. What you do in the first hour shapes everything after it; our breach response guide walks through the sequence.

If you only have one weekend

Do items 1, 3 and 6. Multi-factor on email and remote access, a backup copy you have actually restored from and that is out of reach of your normal credentials, and every leaver's account switched off. That is maybe six hours of work and it closes the three doors that are used most often.

Then work down the list. The ordering is deliberate: prevent the easy entry, make sure you can recover when prevention fails, and remove the access that no longer has an owner. For the wider programme, our small business security guide covers the strategy, the tools comparison covers what to buy, and the budgeting guide covers what it costs. If staff are now using AI assistants that can read company data, add the AI agent endpoint checklist too.