SUAVEX JOURNAL / PRACTICAL GUIDANCE
Small Business Cybersecurity Checklist: Start with What Matters Most
Start with the systems and accounts your business cannot operate without.
You do not need a massive security program to make meaningful progress. Start by protecting the accounts, devices and information your business depends on every day.
Accounts and identity
- Use unique passwords and a password manager.
- Turn on multi-factor authentication for email, cloud applications and administrators.
- Review administrator accounts and remove access that is no longer needed.
- Keep a written list of critical systems and who owns them.
Devices and updates
- Keep operating systems, browsers and business applications updated.
- Use managed endpoint protection on company devices.
- Encrypt laptops and protect them with screen locks.
- Know which devices are company-owned and which are personal.
Email and phishing
- Train staff to pause before opening unexpected links or attachments.
- Verify requests involving money, passwords or sensitive information through a second channel.
- Use spam, malware and impersonation protections where available.
Backups and recovery
- Back up critical files on a schedule.
- Keep at least one backup separated from normal user access.
- Test restoring a file—and document what to do if systems are unavailable.
People and process
- Give new employees a short security orientation.
- Have a simple incident reporting path with no blame for early reporting.
- Review the checklist quarterly and after major business changes.
Need help prioritising the gaps?