Small business cybersecurity checklist: 10 basics that stop most attacks

1. Turn on MFA everywhere

Multi-factor authentication stops the large majority of account takeovers. Turn it on for email, banking, payroll, remote access, and every admin account. Use an authenticator app or passkeys where you can — text messages are better than nothing, but easier to intercept.

2. Separate admin accounts from everyday accounts

Nobody should read email or browse the web while signed in with administrator rights. Give admins a separate account for admin work, and keep daily accounts as standard users. If a daily account is compromised, the damage stays contained.

3. Keep everything patched — and retire what can't be

Turn on automatic updates for operating systems and browsers, and don't forget firewall and router firmware. Replace anything that no longer gets security updates: Windows 10 reached end of support in October 2025, so those machines should be upgraded or replaced.

4. Use real endpoint protection

Free antivirus isn't enough anymore. A modern endpoint detection and response (EDR) tool watches for suspicious behavior, not just known viruses, and can isolate a machine before ransomware spreads.

5. Lock down email

Email is still the front door for most attacks. Set up SPF, DKIM, and DMARC so nobody can easily send email pretending to be your domain, use advanced filtering for phishing and malicious attachments, and tag messages that come from outside the company.

6. Back up with the 3-2-1 rule — and test restores

Keep three copies of important data, on two different types of storage, with one copy offsite. That includes Microsoft 365 or Google Workspace data, which the providers keep only for limited retention windows. Most importantly, test a restore on a schedule. A backup you've never restored from is a guess.

7. Secure the network

Use a business-grade firewall, change every default password, keep guest Wi-Fi separate from company devices and payment systems, and never expose remote desktop directly to the internet. If people need remote access, use a VPN or a zero-trust access tool with MFA.

8. Use a password manager

Unique passwords for every account are only realistic with a password manager. A business password manager also lets you share logins securely and revoke access when someone leaves.

9. Train your team — and verify payment changes

Short, regular phishing awareness training works better than an annual slideshow. Add one simple rule: any request to change bank details or send an urgent payment gets verified by phone, using a number you already have.

10. Know what you'll do when something goes wrong

Write down who to call, how to reach your cyber insurance carrier, how to disable a compromised account, and how to restore from backup. A one-page plan agreed in advance saves hours when it matters.

How to check where you stand

Ask yourself:

• Does every account that can reach company email or money require MFA?
• When did we last restore a file from backup — and did it work?
• Are any of our computers running an operating system that no longer gets updates?
• Could a guest on our Wi-Fi reach our office computers or payment terminals?
• If our email were compromised tonight, who would we call?

If any of those answers is "I'm not sure," that's the place to start. Our free IT assessment reviews all ten of these and gives you a written summary of what's urgent and what can wait. Learn more about our cybersecurity services or call (818) 233-0070.