Small Business Cybersecurity Checklist

The Core Small Business Cybersecurity Checklist

1) Use Multi-Factor Authentication

Employees are often the first line of defense.

Passwords alone are no longer enough. Multi-factor authentication helps reduce the damage a stolen password can cause by requiring another verification step before access is granted.

For most small businesses, the highest-priority places to enable MFA are:

Email accounts
Microsoft 365 or Google Workspace admin accounts
VPN and remote access tools
Backup platforms
Privileged admin accounts

MFA is one of the simplest improvements a business can make to reduce account compromise risk.

2) Protect and Test Backups

Backups are essential, but they only help if they are protected and restorable.

Your checklist should confirm:

Critical business data is backed up regularly
Backups are not exposed to the same attack path as daily systems
Someone is reviewing backup status
Restores are tested periodically
Recovery expectations are documented

Businesses should save important files somewhere that is not connected to the network, which reinforces the need for protected backups rather than assuming any backup is good enough.

3) Keep Systems Patched and Updated

Unpatched systems stay exposed longer than they should.

This includes:

Workstations
Servers
Operating systems
Business software
Browsers
Network Devices
Firmware
Remote Access Tools

We advise businesses to set software to update automatically when possible, and patching is one of the most practical ways to reduce exposure to known vulnerabilities.

4) Use Email Filtering and Web Protection

Email remains one of the most common entry points for phishing, malicious links, and ransomware. Filtering helps reduce what reaches users in the first place.

A strong checklist should include:

Spam Filtering and Phishing Protection
Attachment scanning
Malicious link protection
Domain spoofing protection where appropriate
Web filtering for high-risk content categories

This is one area where better cybersecurity services can reduce risk well before a user ever clicks the wrong thing.

5) Secure User Access and Admin Rights

Many businesses give users more access than they need, then never revisit those permissions.

Your checklist should review:

Who has admin rights
Whether unused accounts are disabled
Whether shared logins still exist
Whether departed employees have been fully removed
Whether file and folder permissions match job roles

Tighter access control helps reduce the damage a compromised account can cause.

6) Train Employees to Spot Threats

Cybersecurity is not just a tools issue. It is a people issue too.

Employee training should help staff:

Recognize phishing attempts
Question unexpected requests
Avoid unsafe attachments and links
Report suspicious activity quickly
Understand basic password and MFA expectations

CTG’s cybersecurity guidance recommends employee training as one of its core recommendations.

7) Protect Your Network and Devices

Your checklist should include the systems that connect everything together.

That means reviewing:

Firewall protection
Secure remote access
Endpoint protection
Wi-Fi security
Device visibility
Segmentation where appropriate
Monitoring for unusual activity

This is where stronger network security becomes an important part of the checklist, especially for growing businesses with more users, more devices, and more cloud access.

8) Create an Incident Response Plan

Even good defenses are not a guarantee. Your business should know what happens if something still goes wrong.

Your checklist should confirm:

Who makes decisions during a cyber incident
How affected devices are isolated
How systems are restored
Who gets notified internally
When customers, vendors, or outside partners need to be informed
What the business does to continue operating during recovery

We recommend having an incident response plan, including a plan for saving data, running the business, and notifying customers if a breach occurs.