The Small Business Cybersecurity Checklist: 25 Controls That Actually Matter

Most small businesses don’t get breached because of a clever, movie-style hack. They get breached because an email account had no second login step, a laptop missed six months of updates, or the only backup sat on a drive plugged into the same server that got encrypted. The fixes for those problems are known, mostly inexpensive, and well within reach of an office manager with a free afternoon.

The hard part is knowing where to start. Security advice tends to arrive as a list of 200 items with no sense of priority. This checklist does the opposite: 25 controls, grouped by area, ordered so the ones that stop the most common attacks come first. Each item explains what to do, why it matters and what “done” looks like.

You don’t need a security team to work through it. You need an owner for each item, a calendar reminder to revisit it, and the willingness to fix the boring things before buying anything shiny.

How to use this checklist

Treat the 25 controls as three tiers. Tier 1 items stop the attacks small businesses see most often: stolen passwords, phishing and ransomware. Tier 2 items reduce the damage when something gets through. Tier 3 items make your security repeatable so it doesn’t depend on one person’s memory.

Tier	Timeframe	Controls	Typical cost
Tier 1: Stop the common attacks	First 30 days	1, 2, 4, 6, 8, 15, 16, 23	Mostly free with tools you already pay for
Tier 2: Limit the damage	Days 31 to 60	3, 7, 9, 11, 12, 13, 14, 18, 19, 20, 21	Low; some time from your IT provider
Tier 3: Make it stick	Days 61 to 90	5, 10, 17, 22, 24, 25	Mostly staff time; optional training or policy templates

Assign every control a named owner, even if that owner is you. “Everyone” owning security is the same as nobody owning it.

Identity and access (controls 1 to 5)

Logins are the front door. Attackers would much rather sign in with a stolen password than break anything, so this group delivers the biggest return.

1. Turn on MFA for email, banking, payroll and every admin account. Email comes first because it is the reset channel for everything else. Prefer an authenticator app with number matching or a passkey over text-message codes. Done means: no user in your email system can sign in with a password alone.
2. Give everyone a business password manager. Unique passwords for every site are impossible without one. A business plan lets you share vault items (like the company social media login) without pasting passwords into chat, and lets you revoke access when someone leaves.
3. Separate admin accounts from daily accounts. The person who reads email and browses the web all day shouldn’t be doing it with global admin rights. Create a dedicated admin login, protect it with the strongest MFA you have, and use it only for admin tasks.
4. Offboard the same day. When someone leaves, disable their accounts, revoke sessions, transfer their files and change any shared credentials they knew. Keep a written offboarding checklist so it happens the same way every time.
5. Review access every quarter. Export the user list from your email platform, accounting software and file storage. Remove former staff, contractors whose projects ended and “test” accounts nobody remembers creating.

For a deeper walkthrough of MFA options and how to roll them out without a revolt, see our guide to passwords, passkeys and MFA.

Devices and software (controls 6 to 10)

Unpatched software is one of the most reliable ways in for attackers, and lost laptops are one of the most common ways data walks out the door.

6. Turn on automatic updates everywhere. Operating systems, browsers, Office or Workspace apps, PDF readers and phone OS updates. If an IT provider manages your devices, ask them for a monthly report showing which machines are behind.
7. Retire unsupported systems. A computer running an operating system that no longer receives security updates will never be fixed again. Plan replacements before the vendor’s end-of-support date, not after.
8. Run endpoint protection and check that it’s on. Microsoft Defender is built into Windows and is a solid baseline; macOS has its own built-in protections. The common failure is not the product choice but finding it disabled or alerting to nobody. Decide who sees alerts.
9. Encrypt every laptop and phone. Turn on BitLocker (Windows) or FileVault (Mac), and require a passcode on phones. A stolen encrypted laptop is a hardware loss; an unencrypted one may be a reportable data breach.
10. Keep a device inventory. A simple spreadsheet works: device, owner, serial number, OS version, encryption status, purchase date. Include phones that access company email. You can’t protect what you don’t know you have.

Email and cloud accounts (controls 11 to 14)

For most small businesses, Microsoft 365 or Google Workspace is the core of the company. Their default settings are reasonable but not tight.

11. Set up SPF, DKIM and DMARC on your domain. These DNS records help receiving mail servers tell the difference between real email from your domain and spoofed email. Start DMARC in monitoring mode, review reports, then move toward a “quarantine” or “reject” policy.
12. Harden your email platform. Block legacy sign-in protocols that bypass MFA, turn on the built-in security baseline (Security Defaults or Conditional Access in Microsoft 365, the security settings in the Google Admin console), and alert on new mailbox forwarding rules. Your IT provider can usually apply these settings in an afternoon.
13. Tag external email and filter risky attachments. An “External” banner makes impersonation of your own staff easier to spot. Block or quarantine executable files and macro-enabled Office documents arriving from outside.
14. Limit file-sharing links. Set the default sharing option to “people in your organization” rather than “anyone with the link,” and periodically review files shared publicly.

Data and backups (controls 15 to 18)

Backups are your insurance policy against ransomware, hardware failure and honest mistakes. They only pay out if they were built correctly.

15. Follow the 3-2-1 rule with an offline or immutable copy. Keep three copies of important data, on two types of storage, with one copy off-site. Make sure at least one copy can’t be changed or deleted from your normal network, because ransomware actively hunts for connected backups.
16. Test a restore every quarter. Pick a folder, a mailbox or a whole machine and restore it. Time how long it takes. An untested backup is a hope, not a plan.
17. Know where sensitive data lives. List the places you store customer records, payment data, health information, employee files and financial records. That list drives everything from access permissions to compliance obligations.
18. Back up your cloud apps too. Microsoft 365 and Google Workspace keep your data available, but their retention features are not a full backup against deletion, sync errors or an attacker with admin access. A third-party SaaS backup is inexpensive and worth it.

Our article on the 3-2-1-1-0 backup strategy explains how to design backups that survive a ransomware attack.

Network security (controls 19 to 21)

19. Update router firmware and change the admin password. Replace default credentials, turn off remote administration from the internet unless you truly need it, and replace equipment the manufacturer no longer updates.
20. Use WPA3 (or WPA2 with AES) and a separate guest network. Visitors, personal phones and smart TVs should not share a network with your accounting PC. Make sure the guest network can’t see internal devices.
21. Close exposed remote access. Never expose Remote Desktop (RDP) directly to the internet. Use a VPN or a remote access service that requires MFA, and keep it patched.

If your router came from your internet provider and nobody has logged into it since installation, assume all three of these need attention.

People and process (controls 22 to 25)

Technology can’t stop someone from wiring money to a convincing fake vendor. Clear habits can.

22. Train staff briefly and often. Short sessions a few times a year beat one long annual video. Pair training with realistic phishing simulations so people practice spotting and reporting suspicious messages.
23. Adopt a payment verification rule. Any request to change bank details, pay a new vendor or send an urgent wire must be confirmed by phone using a number you already have on file, never a number in the email.
24. Write a one-page incident plan. Who to call (IT provider, insurer, bank, lawyer), how to reach them if email is down, and the first three things to do. Print it. A plan stored only on the server that got encrypted is no plan.
25. Put your rules in writing and review vendors. A short acceptable use policy, a password and MFA policy and a list of vendors with access to your systems or data. Ask key vendors how they protect your information.

The 25 controls at a glance

Use this condensed version to track progress. Revisit it every quarter.

If you’d like a quick read on where you stand before you start, our free security risk assessment takes a few minutes and highlights your biggest gaps. The CISA Cyber Essentials guide and the FTC’s Cybersecurity for Small Business resources are also excellent free references that align with this list.

Doing it on a small budget

Most of these controls cost time, not money. If budget is tight, spend it in this order:

• Use what you already pay for. Microsoft 365 Business Premium and the higher Google Workspace tiers include device management, advanced email filtering and conditional access. Many businesses pay for these features and never turn them on.
• Pay for a password manager and a backup service first. Both are inexpensive per user and directly address the two most damaging scenarios: account takeover and ransomware.
• Buy hardware security keys for admins and finance staff. A handful of keys for your highest-risk accounts is a modest one-time cost with a large payoff.
• Get an outside review once a year. A fresh set of eyes catches the settings that drifted and the exceptions that became permanent.

If you’d rather learn the fundamentals at your own pace, our Small Business Cybersecurity for Beginners self-paced program covers this checklist in plain language with step-by-step videos.

How SecuritySage can help

SecuritySage was built for businesses that know security matters but don’t have a security team. Our founder, Dave, spent more than 15 years on both sides of the keyboard, first as a hacker and then defending enterprises, small businesses and startups, and that experience shapes every recommendation we make: fix what attackers actually exploit, in plain English, at a pace your business can sustain.

We can work through this checklist with you as a one-time IT security audit, giving you a prioritized report of what’s done, what’s missing and what to fix first. If you want ongoing guidance, our virtual CISO (vCISO) service gives you a senior security advisor without the full-time salary. Either way, the first step is a conversation. Get started with SecuritySage and we’ll help you turn these 25 controls into a plan that fits your budget.