Security basics
Small Business Cybersecurity Checklist: 10 Practical Priorities
A practical security checklist for small businesses, from MFA and backups to incident planning.
Recommended actions
- Enable multifactor authentication on email, admin and cloud accounts.
- Apply operating system, plugin and firmware updates promptly.
- Maintain tested backups with at least one isolated or offline copy.
- Use unique passwords and a reputable password manager.
- Remove inactive accounts and enforce least-privilege access.
- Protect business email with SPF, DKIM and DMARC where appropriate.
- Inventory devices, websites, domains and critical third-party services.
- Train staff to recognize phishing and payment redirection attempts.
- Document incident contacts, recovery procedures and reporting obligations.
- Schedule periodic security reviews and validate fixes.
Every organization has different risks. These steps are a starting point, not a substitute for a scoped security assessment.