Small businesses are targeted because they are easier, not because they are valuable. The controls that prevent most incidents are unglamorous and inexpensive: multi-factor authentication, patching, backups, and a short list of access rules. This small business cybersecurity checklist is ordered by risk reduction per hour of effort, so you can start today without a security team.
The Twelve Controls
| # | Control | Why it ranks here | Effort |
|---|---|---|---|
| 1 | Multi-factor authentication everywhere | Stops most account takeover from stolen passwords | Low |
| 2 | Tested offline backups | Ransomware becomes an inconvenience, not a closure | Medium |
| 3 | Patch operating systems and browsers | Most exploited flaws have fixes available | Low, ongoing |
| 4 | Email filtering and attachment rules | Phishing is the top initial access route | Low |
| 5 | Least-privilege access | Limits damage from any single compromised account | Medium |
| 6 | Password manager and unique passwords | Ends credential reuse across services | Low |
| 7 | Device encryption and screen locks | Protects data on stolen laptops and phones | Low |
| 8 | Endpoint protection with alerting | Catches malware that slips past filters | Medium |
| 9 | Offboarding checklist | Departed staff retain access longer than anyone expects | Low |
| 10 | Admin accounts separated from daily use | Prevents routine browsing from becoming full compromise | Medium |
| 11 | Written incident response plan | Decides in advance who calls whom | Low |
| 12 | Security awareness training | Reduces click rates on phishing simulations | Low, recurring |
Start With Identity
Nearly every serious incident in a small business begins with a credential. Enable multi-factor authentication on email, banking, accounting software, remote access, and any admin console. Use an authenticator app or hardware key rather than SMS where possible, because SIM swapping is a real attack.
Then remove shared logins. A single account used by five people cannot be audited and cannot be revoked cleanly. Give each person their own account with the minimum permissions their role needs.
Backups That Survive Ransomware
Ransomware encrypts attached drives, including network shares and synced cloud folders. A backup only counts if it is separate and tested.
- 3-2-1 rule: three copies, two media types, one off-site.
- Offline or immutable: at least one copy cannot be modified by an attacker.
- Restore test: restore a real file quarterly and time it. An untested backup is a hope.
- Retention: keep enough history to recover from an infection that stayed quiet for weeks.
Email and Phishing Defence
Configure SPF, DKIM, and DMARC to reduce spoofing of your own domain, and turn on the strongest filtering your provider offers. Train staff on three habits: verify payment changes by phone, hover before clicking, and report suspicious messages rather than deleting them silently.
Business email compromise often needs no malware. A convincing message to your finance contact is enough. A simple rule that any change to bank details requires a callback to a known number prevents most of these losses.
Access, Devices, and Offboarding
Keep an inventory of accounts and who holds admin rights. Review it quarterly. When someone leaves, revoke access the same day, transfer their files, and collect devices. Write this as a checklist so it does not depend on memory during a busy week.
Encrypt laptops and phones, require screen locks, and enable remote wipe. A stolen laptop with full-disk encryption is a hardware loss; without it, it is a data breach with notification obligations.
Incident Response in One Page
Write a single page covering:
- Who declares an incident, and who is the backup.
- How to isolate affected devices without destroying evidence.
- Contact details for your IT provider, insurer, bank, and legal counsel.
- Where the offline copy of this plan lives.
- Who communicates with customers and regulators.
Practise it once a year with a tabletop exercise. The first time you read the plan should not be during the incident.
What to Skip First
Expensive tools rarely compensate for missing basics. If MFA, patching, and backups are not in place, a premium detection platform is premature. Likewise, compliance frameworks can wait until the controls they assume already exist.
If you use a managed provider, ask which of the twelve controls they own and which remain yours. Our IT consulting guide covers how to structure that split, and the IT solutions strategy guide explains how to sequence projects without stalling operations.
For remote work specifically, the VPN guide covers what a VPN does and does not protect, which matters before you assume it replaces the controls above.
What is the single most important cybersecurity control for a small business?
Multi-factor authentication on email and financial accounts. It blocks most account takeover attempts that begin with a stolen password.
How often should backups be tested?
At least quarterly. Restore a real file and time the process; an untested backup often fails when needed.
Do small businesses need a VPN?
A VPN protects traffic on untrusted networks, but it does not replace MFA, patching, or backups. Treat it as one layer, not a solution.
What should an incident response plan include?
Who declares an incident, how to isolate devices, contact details for providers and insurers, where the offline plan lives, and who communicates externally.
About the Author
