A cyberattack does not have to target a large company to cause serious damage. A small business can lose access to its email, customer records, invoices, or website because of one reused password, an unpatched device, or a convincing phishing message.

The good news is that basic security habits can prevent many common problems. This small business cybersecurity checklist covers practical steps you can take without building a large IT department. Start with the essentials, assign someone to own each task, and review your setup regularly.

Small Business Cybersecurity Checklist

1. List the accounts, devices, and data you need to protect

You cannot secure systems you do not know about. Make a simple inventory of company laptops, phones, email accounts, cloud storage, payment services, website logins, and software subscriptions.

For each item, record who can access it and whether it stores sensitive information. Include accounts used by contractors and former employees. This list gives you a clear starting point when you need to remove access or respond to a security incident.

2. Turn on multi-factor authentication

Enable multi-factor authentication (MFA) on business email, cloud storage, financial accounts, website administration, and remote access. MFA asks for an additional proof of identity after a password, making it harder for someone to enter an account with a stolen password alone.

Use a passkey, security key, or authenticator app when available. If a service only offers text-message codes, that is generally better than password-only access, but choose a stronger method when you can. CISA recommends MFA for small and medium-sized businesses and advises aiming for phishing-resistant MFA where possible.

3. Use unique passwords and a password manager

A password reused across several sites can put all of those accounts at risk if just one service is breached. Give every business account its own long, unique password. A reputable password manager can create and store them so staff do not need to remember each one.

Protect the password manager itself with MFA. Do not share passwords through group chats, email, or an unprotected spreadsheet. When an employee or contractor leaves, change shared credentials and remove their individual access.

4. Install updates promptly

Keep computers, phones, browsers, routers, business apps, and website software up to date. Updates often fix security weaknesses that attackers may already know about.

Turn on automatic updates where practical. For devices that cannot update automatically, assign someone to check them on a regular schedule. Replace software that no longer receives security updates, especially if it connects to the internet or holds business data.

5. Limit access to what each person needs

Give each worker access to the tools and information required for their role. Avoid using one shared administrator account for everyday work. Keep a separate administrator account for system changes, and protect it with a unique password and MFA.

Review permissions when someone changes roles or leaves. Also check integrations and third-party apps connected to your email, cloud drive, website, or payment platform. Remove access that is no longer needed.

6. Back up important business data

Back up customer records, financial files, website content, and other information you would need to keep operating. A backup should remain available if a laptop is stolen, files are deleted, or ransomware locks your systems.

Keep at least one backup separate from the devices and accounts it protects. If every backup is connected to the same compromised account, an attacker may be able to reach it too. Test restoring a few files periodically; a backup is only useful if you can recover the data.

7. Help staff recognize phishing

Phishing messages may pretend to come from a bank, supplier, delivery company, customer, or business owner. They often create urgency and ask the recipient to open an attachment, click a link, change payment details, or share a login code.

Give staff a simple way to report suspicious messages. For payment or bank-detail changes, verify the request using a phone number or contact method you already trust, rather than the details in the message. Make it clear that employees should report a mistake quickly—early reporting can limit the damage.

8. Protect laptops and phones

Require screen locks and strong device passcodes. Turn on device encryption and remote-wipe features where available, especially for phones and laptops used outside the office. Keep work data off personal devices when possible, or set clear rules for accessing company accounts from them.

If a device goes missing, know who should disable its accounts and report the loss. Do not wait until the next routine review to remove access from a lost phone or laptop.

9. Secure your Wi-Fi and router

Change the router’s default administrator password and use current security settings. Keep its firmware updated, and disable remote administration if your business does not need it. Give guests a separate Wi-Fi network so their devices are not on the same network as business computers and printers.

If your router is no longer supported by its manufacturer, plan to replace it. An old router that cannot receive security updates can remain a weak point even when newer computers are well protected.

10. Check vendors and outside services

Small businesses often rely on payroll providers, cloud software, website hosts, accountants, and marketing platforms. Find out which providers can access your data, what information they store, and how to contact them if something goes wrong.

Use separate logins for each service instead of sharing your main business password. Remove old integrations and user accounts. For services that handle sensitive data or payments, review the provider’s security and account-recovery options before relying on them.

11. Make a simple incident plan

Write down what to do if an account is hacked, a device is lost, or business files become unavailable. Include the names and phone numbers of the people responsible for technology, finances, communications, and key vendors.

The first steps may include disconnecting an affected device from the network, changing passwords from a clean device, contacting the bank or service provider, and preserving relevant messages or logs. The right response depends on the incident, so identify your technical support contact before you need one.

12. Review the checklist regularly

Cybersecurity is an ongoing routine, not a one-time setup. Choose a monthly or quarterly review date to check software updates, MFA, employee access, backups, and vendor accounts. Revisit the list whenever you hire someone, adopt a new service, move offices, or change how customer data is handled.

A short, consistent review is easier to maintain than a complicated policy nobody follows.

What should a small business do first?

If you are starting from scratch, take these steps first:

1. Turn on MFA for business email and financial accounts.
2. Replace reused passwords with unique ones stored in a password manager.
3. Update your computers, phones, router, and business software.
4. Back up important files and test restoring a sample.
5. Remove access for former employees and unused apps.
6. Tell staff how to report suspicious messages or unexpected payment requests.

These actions reduce common risks while giving you a foundation to improve over time.

How much does small business cybersecurity cost?

The first steps may cost little or nothing: enabling MFA, updating software, reviewing account access, and setting up a basic incident plan are often available through tools a business already uses. A password manager, managed IT support, or improved backup service may add costs, depending on the company’s needs.

Prioritize the accounts and information that would hurt most to lose. If your business handles regulated, medical, or payment-card data, check the requirements that apply to your industry and location. This checklist is a starting point, not a substitute for a professional security assessment.

Final thoughts

A practical small business cybersecurity checklist does not need to be complicated. Know what you use, protect important accounts with MFA and unique passwords, keep software updated, maintain tested backups, and make sure everyone knows how to report a suspicious message.

Pick one person to own the checklist and set a date for the next review. Small, repeatable steps make it easier to spot gaps before they become business disruptions.

Frequently Asked Questions

What is the most important cybersecurity step for a small business?

Start by enabling MFA on business email, financial accounts, and cloud services. Then use unique passwords, keep software updated, and make sure important data is backed up.

Do small businesses need a cybersecurity policy?

A short written policy helps employees know how to protect accounts and data, report suspicious activity, and handle lost devices. Keep it practical and update it when your tools or team change.

How often should a small business review its cybersecurity?

Review access, updates, backups, and vendor accounts at least quarterly. Check sooner after staff changes, a new software rollout, or a security incident.

Are cloud backups enough?

Cloud backups can be useful, but check whether they are protected by separate account access and whether you can restore files. Keeping a backup isolated from the systems it protects can reduce the chance that one compromised account affects everything.