A small business cybersecurity checklist you can actually finish

The short answer

A good small business cybersecurity checklist starts with the few controls that stop most attacks: multi-factor authentication (MFA) on every account, tested backups, automatic updates, endpoint protection and a clean list of who has access to what. Then it adds email protection, a password manager, staff training and a written plan for when something goes wrong.

The checklist below puts those items in the order we would tackle them. Each group maps to the six functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), which NIST summarizes for small businesses in its Quick Start Guide, and to CISA’s Cyber Essentials. Work top to bottom. If you only finish the first section, you are already ahead of many firms.

This week: stop the most common break-ins

These items map to NIST’s Protect function and to CISA’s “Your Systems”, “Your Surroundings” and “Your Data” essentials.

1. Turn on MFA for email for every user, with no exceptions for the owner.
2. Turn on MFA for remote access: VPN, remote desktop tools, payroll, banking and your accounting software.
3. Separate admin accounts. Nobody should read email while signed in as a global administrator.
4. Remove former employees and old vendors from email, cloud apps, shared drives and the Wi-Fi password list.
5. Confirm automatic updates are on for Windows, macOS, browsers and Microsoft 365 or Google Workspace apps.
6. Check that a backup exists for email, cloud files and any server, and that at least one copy is offline or cannot be deleted from your normal admin account.

This month: close the obvious gaps

1. Run a test restore of a folder and a mailbox. A backup you have never restored is a guess.
2. Put endpoint detection and response (EDR) on every laptop, desktop and server, not just antivirus.
3. Turn on disk encryption (BitLocker on Windows, FileVault on Mac) so a stolen laptop is not a data breach.
4. Roll out a business password manager and stop shared spreadsheets of passwords.
5. Block automatic forwarding of email to outside addresses, a common trick after a mailbox is taken over.
6. Publish SPF, DKIM and DMARC records for your domain so others cannot easily send email as you.
7. Change default passwords on the router, firewall, printers and cameras, and update their firmware.
8. Put guests on a separate Wi-Fi network from the computers that hold business data.
9. Remove local admin rights from everyday users so malware cannot install itself as easily.
10. Require screen locks and PINs on computers and phones that reach company email.
11. Turn on audit logging in Microsoft 365 or Google Workspace so you can investigate later.

This quarter: know what you have and who owns it

This is NIST’s Identify and Govern work, and CISA’s “Yourself, the Leader” essential: someone has to own security.

1. Name one person responsible for security decisions, even if a provider does the work.
2. List your devices: every computer, phone, server and network device, with its owner.
3. List your software and cloud services, including who pays for each and who is an admin.
4. Mark where sensitive data lives: client files, payment data, health or HR records.
5. Write down vendor access. Which outside companies can log in to your systems, and how?
6. Replace or isolate end-of-life systems that no longer get security updates.
7. Review your cyber insurance questionnaire answers against what is actually in place. Our cyber insurance requirements guide lists what carriers ask.

Want a second pair of eyes on this list? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report that rates your cybersecurity, IT operations and business continuity as controlled, needs attention, significant exposure or unknown, with the next steps in order. It is yours to keep, with no obligation. Book your assessment.

Before the end of the year: prepare for a bad day

These items cover NIST’s Detect, Respond and Recover functions and CISA’s “Your Crisis Response” essential.

1. Make sure alerts reach a person. EDR and Microsoft 365 alerts are useless if nobody reads them.
2. Write a one-page incident plan: who to call first (IT, insurer, bank, attorney), how to reach them if email is down, and who can approve spending.
3. Keep a paper or offline copy of that plan and key phone numbers.
4. Write a payment verification rule: any new or changed bank details are confirmed by phone using a number you already have.
5. Run a 30-minute tabletop exercise. CISA publishes free tabletop exercise packages you can adapt.
6. Train staff with short sessions on phishing, text and phone scams, and how to report something odd.

Recurring tasks and how often

Security drifts if nobody revisits it. Put these on a calendar.

Same-day removal of leavers belongs on every offboarding list, not a schedule. Our employee offboarding IT checklist covers it step by step.

Where small businesses usually fall short

When we review small offices, the same gaps come up again and again. Check these honestly.

• MFA with exceptions. The owner, a shared front-desk mailbox or an old service account was left out because MFA was inconvenient. Attackers look for exactly those accounts.
• Backups nobody has restored. The software reports success every night, but nobody knows how long a full recovery takes or whether the cloud data is included.
• Old accounts. Former staff, a past bookkeeper or a previous IT company still has working access.
• Alerts going to a dead inbox. Security tools are installed, but warnings go to someone who left or to a mailbox nobody reads.
• Insurance answers that do not match reality. The renewal form says MFA and EDR are everywhere, but a few machines or accounts were missed. That gap can matter at claim time.

None of these need expensive tools. They need someone to check and keep checking.

How to use this checklist without an IT department

• Work in short sessions. Two items a week finishes the first two sections in about two months.
• Record the date and who did each item, so you can answer insurance and client questions later.
• Mark anything you cannot verify as unknown, not done. Unknowns are where problems hide.
• Ask your software vendors for help with their part; most have security settings guides.
• Get help for the items that need technical access, such as EDR rollout, email records and backup testing.

JLB USA’s cybersecurity services cover most of this list for businesses with about 25 to 100 employees, including MFA, access reviews, endpoint protection, email security, monitored backups with tested restores and a written recovery plan. We can also work alongside an existing IT person.

Keep reading

• How to protect against ransomware: the controls that work for small businesses
• What to do after a ransomware attack: the first 24 hours
• How much does cybersecurity cost for a small business in 2026?
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Microsoft 365 security settings