Small business cybersecurity checklist: the 10 controls that matter most

Small businesses rarely get hit by anything clever. The usual story is a reused password on an email account with no second factor, a fake invoice that gets paid, or ransomware on a laptop nobody had updated in a year. The controls below are roughly ordered by how much trouble they prevent per hour of effort, with one exception: number 5, the payment rule, takes a single meeting and belongs in your first week. Do the first five this month and you have closed off most of what goes wrong.

Your email account is the master key. Whoever controls it can reset the password on your bank, your payroll provider and your accounting software. So multi-factor authentication goes on email first, then on banking, payroll, accounting, your domain registrar and any cloud storage.

• Microsoft 365: newer tenants usually have Microsoft's security defaults switched on already. Check in the Microsoft Entra admin center, under your tenant's properties, that security defaults are enabled. They require every user to register for MFA and block older sign-in methods that skip it. If you pay for Business Premium, Conditional Access policies give you finer control, but security defaults are a perfectly good start.
• Google Workspace: in the Admin console, go to Security > Authentication > 2-step verification. Allow users to turn it on, give them a week or two to enroll, then switch enforcement on.

An authenticator app or a passkey beats text-message codes. Hardware security keys are worth buying for the owner, whoever runs payments, and any admin account. Our guide to two-factor authentication explains the options.

If the Wi-Fi password, the supplier portal login and the bank's online access live in a shared spreadsheet, a group chat or a sticky note, a business password manager fixes that. Each person gets their own vault, you create shared vaults for team logins, and when someone leaves you remove their access in one place.

Three good choices for small teams are 1Password Business, Bitwarden (Teams or Enterprise plans, with open-source apps) and Proton Pass for Business. All three offer shared vaults, admin controls and apps on every platform. Bitwarden tends to be the budget pick; 1Password is the one many IT people already know. The built-in Apple and Google password managers are fine for personal use but are weak at shared business vaults and offboarding. See our password manager comparison for the details.

Once it is in place, run a quick check of the owner's and admins' email addresses at Have I Been Pwned, and change any password that turns up there. Our guide to checking for leaked passwords walks through it.

Most successful attacks use flaws the vendor fixed months earlier. Turn on automatic updates for Windows, macOS, iOS, Android, browsers and Microsoft Office or Google's apps. Replace anything that no longer gets security updates: an old Windows PC that cannot run a supported version is a liability, however well it runs. Do not forget the router, the printer and the NAS box in the back room. Our guide to keeping devices updated covers the settings.

Every laptop and desktop also needs endpoint protection. For a two-person shop on Windows, the built-in Microsoft Defender Antivirus may be enough. Once you have staff, you want something with a central console, so you can see every device, know it is protected and get alerts when something is caught. If you already pay for Microsoft 365 Business Premium, Defender for Business is included and is the obvious first look. Other options include CrowdStrike Falcon Go and Bitdefender's GravityZone business line. We compare them in our endpoint protection guide.

Backups are what turn ransomware from a business-ending event into a bad week. The old 3-2-1 rule still holds: three copies of your data, on two different kinds of storage, with one copy off-site. Add one more rule for ransomware: at least one copy should be offline or immutable (a backup that cannot be changed or deleted for a set period, even by an admin account). Ransomware operators look for connected backup drives and delete or encrypt them first.

• Microsoft 365 and Google Workspace keep your mail and files available, but their retention and recycle bins have limits. A third-party backup of the tenant is worth considering if those files are the business.
• Back up the accounting data, client files and any line-of-business software, not only shared drives.
• Test a restore every quarter. Pick a folder, restore it somewhere else, and open the files. Untested backups fail at the worst moment.

This one costs nothing and stops the single most expensive scam small businesses face. Write it down and tell everyone who can move money: any new payee or any change to a supplier's or employee's bank details is confirmed by phone, using a number you already had on file, never a number in the email asking for the change. The same goes for urgent payment requests that appear to come from the owner, and for any request to buy gift cards.

Add a second approver for payments above a threshold you are comfortable with. Our guide to business email compromise explains how these scams work and what to do if money has already gone.

When someone leaves, their access should leave the same day. Keep a short offboarding list: disable their email account (convert it to a shared mailbox if you need the mail), remove them from the password manager, sign them out of every device, collect company laptops and phones, change any shared passwords they knew, and remove them from the bank, payroll and social media accounts. Do the same review once a year for current staff. People collect access they no longer need.

Admin rights should live on a separate account. The person who manages your Microsoft 365 or Google Workspace should have one everyday account for email and browsing and a different account, protected with a security key, used only for admin work. On the computers themselves, everyday users should not be local administrators. A phishing email that lands on a normal account then has far less to work with.

Turn on your router's guest network and put visitors, personal phones and smart devices (the TV in the meeting room, the thermostat, the music system) on it. Keep the work computers and printers on the main network. Use WPA2 or WPA3 with a long password, change the router's admin password from the default, and keep its firmware updated. Our Wi-Fi security guide covers the settings, and staff who work from cafes should read the one on public Wi-Fi.

For phishing, a short session once or twice a year does more than an annual video nobody watches. Show real examples, explain that urgency and secrecy are the tells, and make reporting easy and blame-free. A staff member who clicks and tells you at once is a success story. Point people to our guide on spotting phishing emails.

When something goes wrong, nobody thinks clearly. Put these on one page, printed, because your email may be the thing that is down:

1. Who decides, and who is their backup.
2. Your IT provider or a local firm you would call, with phone numbers.
3. Your bank's fraud line, for stopping or recalling payments.
4. Your cyber insurance claims hotline and policy number. Many policies want you to call them before hiring anyone, and may require you to use their approved responders.
5. The FBI's Internet Crime Complaint Center, IC3.gov, for fraud and ransomware. File quickly if money moved.
6. Where the backups are and how to restore them.

If you are shopping for cyber insurance, expect the application to ask about MFA, backups and endpoint protection. Having the controls above in place makes that form much easier to fill in.

Several government resources are free and written for businesses your size. The FTC's Cybersecurity for Small Business pages cover the basics with handouts you can give staff. CISA publishes Cyber Essentials, a plain guide for leaders, and keeps a list of free cybersecurity services and tools, some of which, such as vulnerability scanning, CISA offers to eligible organizations directly. The SBA also has a cybersecurity page.

Sole owners often form an LLC using their home as the business and registered address. In many states those filings are public and searchable, and people-search sites and scammers harvest them. That is how a fake "annual report due" letter or an angry customer finds your front door.

A registered agent service gives the state a commercial address to publish instead and receives legal mail on your behalf. If you already have an office, use that and skip the service. If you are forming a new company from home, Bizee (affiliate link) is one formation company that includes registered agent service; check your state's filing rules first, because a few states publish member or manager addresses whatever agent you use. Our guide to removing your info from data broker sites covers the personal side.