Small Business Cybersecurity Checklist

Small-business cybersecurity does not require an enterprise-sized security department, but it does require deliberate controls around accounts, devices, email, networks, backups, vendors and incident response. This checklist provides a practical starting point for reducing common risks and building a security program that can mature with the business. The same approach can help startups establish an initial cybersecurity baseline before their technology environment becomes more complex.

What should a small-business cybersecurity program cover?

Cybersecurity is easier to manage when it is treated as an ongoing business process rather than a collection of unrelated products.

The NIST Cybersecurity Framework 2.0 organizes cybersecurity risk management around six functions: Govern, Identify, Protect, Detect, Respond and Recover. A small business does not need to turn those functions into a large compliance project to benefit from the underlying idea.

In practical terms, the business should know what technology and data it depends on, decide who is responsible for security decisions, protect important systems, watch for problems, know what to do when something goes wrong and maintain a way to recover.

1. Know what you are protecting

Start with a basic inventory. A company cannot reliably protect technology it does not know it has.

Identify important:

• laptops, desktops and mobile devices;
• servers and NAS devices;
• routers, firewalls, wireless access points and other network equipment;
• Microsoft 365, Google Workspace and other cloud services;
• business applications and databases;
• administrator and service accounts;
• vendors with access to company systems or data; and
• information the business would struggle to operate without.

Include cloud services in the inventory

A technology inventory should not stop at physical equipment. Document important SaaS platforms, who administers them, which employees have access and what happens to business data when an account is removed.

Assign an owner

Someone should be responsible for maintaining the inventory and coordinating security decisions. In a small company that might be an owner, internal IT employee or managed service provider rather than a dedicated security team.

2. Protect important accounts with MFA

Multifactor authentication (MFA) adds another authentication factor beyond a password. It is particularly important for email, administrator accounts, remote access, financial systems and services containing sensitive business information.

Prioritize the accounts with the greatest impact

If MFA cannot be deployed everywhere immediately, start with privileged accounts, email administrators, remote-access accounts and systems whose compromise could expose important company information.

Prefer stronger authentication when supported

Not every MFA method provides the same resistance to phishing. Where business systems support phishing-resistant authentication such as appropriately implemented passkeys or hardware-backed methods, evaluate whether those options fit the organization.

Passkeys will not replace every authentication method overnight, so businesses still need secure password and MFA practices for systems that do not support them.

For a deeper implementation guide, see MFA for Small Business.

3. Use unique credentials and manage passwords centrally

Employees should not reuse the same password across business services. One compromised service can otherwise expose credentials that work elsewhere.

Use a business password manager where it fits

A business password manager can help employees generate unique credentials, share approved credentials without sending passwords through ordinary messages, and give administrators more control over access.

See Does a Small Business Need a Password Manager? and Best Password Managers for Small Business for the broader decision.

Control shared accounts

Whenever possible, give employees individual accounts rather than sharing one username and password. Individual identities improve accountability and make offboarding easier.

4. Limit administrator access and follow least privilege

Employees should have the access necessary for their work without automatically receiving administrator rights everywhere.

Separate ordinary work from privileged administration

Where practical, avoid using highly privileged administrator accounts for everyday email and web browsing. Administrative credentials have greater impact if compromised.

Review access when roles change

Promotions, department changes and temporary projects can leave employees with access they no longer require. Include access review in role changes as well as employee departures.

5. Keep operating systems, applications and devices updated

Security updates address known vulnerabilities in operating systems, browsers, business applications and infrastructure devices.

Enable automatic security updates where appropriate and establish a process for software or equipment that requires manual maintenance.

Do not forget infrastructure

Routers, firewalls, wireless access points, NAS devices, printers and other network-connected equipment may also receive firmware or security updates.

Replace technology that can no longer be secured

When an operating system or device no longer receives appropriate security support, replacement may become part of the security plan.

For computer lifecycle planning, see When Should a Small Business Replace Its Computers?.

6. Protect business computers with endpoint security

Business endpoints should have appropriate protection against malicious software and other endpoint threats. Depending on the environment, this may include built-in operating-system protections, centrally managed antivirus, endpoint detection and response (EDR), or a managed security service.

Antivirus and EDR are not identical

Traditional antivirus focuses heavily on detecting and blocking malicious software. EDR generally adds greater visibility into endpoint activity, investigation and response capabilities.

A five-person office does not automatically need the same endpoint platform as a large enterprise. Match the tooling to the risk, internal expertise, regulatory obligations and ability to monitor alerts.

Make sure protection is actually managed

Installing software is not the end of the control. Confirm that expected devices are reporting, definitions and engines are current, important alerts reach someone and employees cannot casually disable required protection.

7. Encrypt business devices where appropriate

Device encryption can reduce the risk of exposing data when a laptop or storage device is lost or stolen.

Windows device encryption and BitLocker

Supported Windows editions and hardware can provide device-encryption capabilities, including BitLocker in appropriate configurations. Before enabling encryption broadly, understand how recovery keys are stored and how the business will regain access if an employee leaves or hardware changes.

Recovery-key management matters

Encryption without a reliable recovery process can create an availability problem. Store recovery information through an approved administrative process rather than relying on one employee to remember where a key is located.

Our Windows 11 Pro vs. Home for Small Business explains other business-oriented Windows capabilities.

8. Secure the business router, firewall and network

The internet connection is part of the security boundary. Change default administrative credentials, keep router and firewall firmware current, disable unnecessary remote administration and review exposed services.

Use a firewall appropriate for the environment

A firewall can control network traffic, but product requirements vary considerably. A small office may rely on capabilities built into a business router, while a larger or more complex environment may justify a dedicated security appliance or managed firewall.

Do not assume that buying a more expensive firewall automatically makes the network secure. Configuration, updates, administrative access and monitoring still matter.

See Business Router vs. Consumer Router for related infrastructure considerations.

9. Separate guest Wi-Fi and untrusted devices

Visitors and personal devices generally do not need the same network access as managed business computers.

A separate guest network can reduce unnecessary access between untrusted devices and internal business resources.

Consider other device categories too

Printers, cameras, smart displays and other connected devices may not need unrestricted access to employee computers or servers. Network separation can help limit the impact of a poorly secured device.

See Guest Wi-Fi for Small Business and Best Wi-Fi Setup for Small Business.

10. Strengthen email security and prepare for phishing

Email attacks are not limited to obvious malicious attachments. Attackers may try to steal credentials, impersonate executives or vendors, redirect payments, abuse legitimate cloud services or convince an employee to change account information.

Business email compromise

Business email compromise (BEC) often relies on impersonation and social engineering rather than malware alone. Establish an independent verification process for unusual payment requests, bank-account changes and other high-impact instructions.

Use the protections available in the email platform

Microsoft 365, Google Workspace and third-party email-security platforms provide different combinations of spam filtering, malicious-link or attachment protection, impersonation detection, quarantine, reporting and administrative controls.

Review what is included in the organization's current subscription before purchasing overlapping tools.

If you are selecting or replacing the service that hosts your company mailboxes, see our Best Secure Email Providers for Small Business comparison.

Understand SPF, DKIM and DMARC

SPF, DKIM and DMARC are email-authentication technologies that can help receiving systems evaluate whether messages claiming to come from a domain are authorized and how authentication failures should be handled.

They are useful controls, but they do not eliminate phishing or business email compromise. Deployment should be planned carefully so legitimate senders are identified before stricter DMARC enforcement is applied.

11. Train employees to recognize and report suspicious activity

Security awareness should teach employees what to do, not simply tell them to "be careful."

Training can cover:

• phishing and credential-harvesting attempts;
• unexpected MFA prompts;
• payment and bank-change fraud;
• suspicious attachments and links;
• impersonation through email, text or collaboration tools;
• safe handling of company information; and
• how to report a suspected incident quickly.

Make reporting easy

Employees are more useful as a detection layer when they know exactly where to send a suspicious message or whom to contact after clicking something questionable.

A culture that encourages prompt reporting is generally more useful than one that causes employees to hide mistakes.

12. Secure remote access

Remote work can expose administrative interfaces and business systems outside the traditional office network.

Avoid unnecessary direct exposure

Do not expose management interfaces or remote-desktop services directly to the internet merely for convenience. Use an appropriately secured remote-access method and restrict access to the systems and users that need it.

Use MFA for remote access

Remote-access accounts deserve high priority for MFA because compromised credentials can otherwise provide an attacker with a direct path into business systems.

13. Maintain backups that can survive a security incident

Backups are part of cybersecurity because prevention can fail. Ransomware, compromised accounts, accidental deletion and destructive administrative actions can all create recovery requirements.

Separate recovery from production

Ask whether the same credentials or failure that affects production could also remove every usable recovery copy.

A resilient strategy may combine local and off-site recovery layers, protected retention, or other forms of administrative and storage separation.

Test restores

A successful backup job does not prove that important data can be restored. Perform representative recovery tests and document the results.

Our Small Business Backup Strategy covers RPO, RTO, retention, monitoring and restore testing, while Best Backup Solutions for Small Business covers the underlying backup architecture.

14. Build security into onboarding and offboarding

Employee lifecycle processes are security controls.

When an employee joins

• Create an individual account rather than reusing another employee's identity.
• Enroll required MFA.
• Provide only the access needed for the role.
• Confirm the assigned computer receives required security controls and backups.
• Explain how to report suspicious activity.

When an employee leaves

• Disable or remove access at the appropriate time.
• Revoke active sessions where appropriate.
• Recover company devices and credentials.
• Transfer ownership of business files and shared resources.
• Review shared secrets the employee could access.
• Preserve required business data before deleting accounts or licenses.

15. Create a simple incident-response plan

Small businesses do not need a hundred-page incident-response manual to improve their response. They do need to know who makes decisions and what the first actions are.

Define who to contact

Document internal decision makers, IT or MSP contacts, important vendors and other resources that may be needed during an incident.

Define the first response steps

The appropriate action depends on the incident, but the plan should address how employees report suspected compromise, who investigates, how affected systems can be isolated when necessary, how evidence and important records are preserved, and who decides when recovery begins.

Plan communications before an emergency

Know who is responsible for communicating with employees, customers, insurers, legal counsel, vendors or authorities when those communications are appropriate. Notification obligations vary by the type of data, contracts and applicable law, so obtain qualified guidance where required.

Practice the plan

A short tabletop exercise can reveal missing phone numbers, unclear responsibilities and recovery assumptions before a real incident occurs.

16. Review cloud services and vendors

A vendor can affect security even when it never enters the office.

Ask practical security questions

Depending on the service and risk, evaluate:

• whether MFA and administrative controls are available;
• how user access is provisioned and removed;
• what data the provider stores;
• how data can be exported or recovered;
• what security and availability commitments are documented;
• how incidents affecting customers are communicated;
• what subcontractors or integrations have access; and
• what happens to company data when the relationship ends.

Put important expectations in writing

For higher-impact vendors, security and data-handling expectations should not depend solely on sales conversations. Appropriate contractual terms can clarify responsibilities, access, incident notification, data return and other requirements.

17. Review Microsoft 365 and Google Workspace security settings

Cloud productivity platforms contain email, files, identities and administrative controls, making tenant configuration an important part of the security program.

Microsoft 365

Review administrator roles, MFA, external sharing, email-security settings, audit capabilities and the organization's recovery requirements. Available controls depend on the Microsoft 365 plan and configuration.

Google Workspace

Similarly, review administrator privileges, two-step verification, sharing controls, application access and security alerts appropriate to the organization's Workspace edition.

Do not assume default settings match every business's risk or operational requirements.

18. Monitor the controls you depend on

Security tools create little value if important failures and alerts are never reviewed.

A small business does not need a large security operations center to establish basic monitoring. It does need ownership.

Examples worth monitoring

• important account and administrator alerts;
• endpoint-protection warnings;
• failed or missing backups;
• unexpected remote-access activity;
• security alerts from Microsoft 365, Google Workspace or other critical services;
• new administrator accounts or privilege changes where visibility is available; and
• devices that stop reporting to management or security systems.

19. Review the security program regularly

A checklist is not a one-time project. Technology, employees, vendors and threats change.

Quarterly lightweight review

A small organization can periodically check whether new employees, devices, SaaS applications or vendors have been added; whether important alerts are being reviewed; whether backups and endpoint protection are healthy; and whether old accounts or privileges should be removed.

Review after major changes

A move to a new office, adoption of a new cloud platform, acquisition, remote-work change, server deployment or significant staffing change should trigger a security review rather than waiting for the next scheduled checkpoint.

A practical 30-day small-business cybersecurity rollout

A company starting from a limited security baseline can use a phased approach rather than trying to implement everything simultaneously.

The order can change when a business has a known high-risk exposure. For example, an internet-exposed unsupported server or compromised account deserves attention before a normal rollout schedule.

Minimum viable small-business cybersecurity stack

For a small office with limited resources, a reasonable baseline is less about buying a long list of products and more about ensuring that several essential functions are actually covered.

• Managed business identities with MFA.
• Unique credentials and a controlled way to manage passwords.
• Supported and updated computers.
• Active endpoint protection.
• Device encryption where appropriate.
• A securely configured router/firewall.
• Separated guest access.
• Email and phishing protections.
• Reliable backups with tested recovery.
• Documented onboarding and offboarding.
• A basic incident-response process.
• Someone responsible for reviewing important alerts.

The exact products can vary. What matters is that the security function is covered and someone knows whether it is working.

Small-business cybersecurity checklist

• Maintain an inventory of important devices, applications, cloud services and vendors.
• Assign responsibility for cybersecurity decisions.
• Enable MFA on important accounts.
• Use unique credentials and manage shared access deliberately.
• Limit administrator privileges.
• Keep operating systems, applications and infrastructure updated.
• Use appropriate endpoint protection.
• Encrypt business devices where appropriate and manage recovery keys.
• Secure router and firewall administration.
• Separate guest Wi-Fi and untrusted devices.
• Review email security and domain-authentication controls.
• Train employees to recognize and report suspicious activity.
• Secure remote access and require MFA where supported.
• Maintain backups that can survive a security incident.
• Test representative restores.
• Include security in onboarding and offboarding.
• Maintain a simple incident-response plan.
• Review security expectations for important vendors.
• Review Microsoft 365 or Google Workspace security settings.
• Monitor the security and recovery controls the business depends on.
• Reassess the program periodically and after major changes.

Frequently asked questions

What cybersecurity does a small business need?

Needs vary by the systems, data and risks involved, but common foundations include MFA, unique credentials, security updates, endpoint protection, secure network configuration, phishing defenses, reliable backups, controlled administrative access and an incident-response process.

Is antivirus enough for a small business?

No single endpoint product covers the entire security program. Antivirus or endpoint protection can be important, but businesses also need identity protection, updates, network security, backups, employee awareness, access control and recovery planning.

Does a small business need a firewall?

A business internet connection should have appropriate firewall functionality, but that does not always mean purchasing a separate appliance. The right approach depends on the network, remote-access requirements, number of locations, internal expertise and security needs.

Does Microsoft 365 include email security?

Microsoft 365 provides email and security capabilities that vary by subscription and configuration. Review the controls included in the organization's actual plan before deciding whether additional email-security services are necessary.

What are SPF, DKIM and DMARC?

They are technologies used in email authentication. SPF helps identify authorized sending infrastructure, DKIM uses cryptographic signatures to help validate messages, and DMARC lets a domain owner publish policy and reporting information based on authentication results. They reduce certain forms of domain spoofing but do not eliminate phishing.

Should a small business use passkeys?

Passkeys can provide strong, phishing-resistant authentication on supported platforms and services. Businesses should evaluate support, device management, account recovery and employee workflows rather than assuming passkeys can immediately replace every existing login method.

How often should a small business review cybersecurity?

Review important controls continuously or through alerts where possible, perform periodic lightweight reviews, and reassess the environment after meaningful changes such as new employees, systems, vendors, locations or cloud services.

What should a small business do after a cyber incident?

Follow the organization's incident-response process, involve the appropriate technical and business contacts, contain affected systems where appropriate, preserve needed information, determine recovery steps and obtain qualified legal, insurance or regulatory guidance when the circumstances require it.

For device security, compare centrally managed options in our Best Endpoint Protection for Small Business guide.

Bottom line

Small-business cybersecurity is strongest when it is treated as a repeatable management process rather than a shopping list.

Know what the business depends on, protect important identities and devices, reduce unnecessary access, secure email and networks, maintain recoverable backups, prepare employees to report suspicious activity and know how the organization will respond when prevention fails.

Then review the program as the company changes. New employees, cloud services, vendors, remote-access methods and devices can create security gaps even when the original controls continue working exactly as configured.

Sources and further reading

• NIST — Small Business Cybersecurity Corner
• NIST — Cybersecurity Framework
• CISA — Small and Medium Businesses
• CISA — Secure Our World
• FTC — Cybersecurity for Small Business
• Microsoft Learn — BitLocker
• Microsoft Learn — Enable passkeys in Microsoft Entra ID