The Small Business Cybersecurity Checklist (What to Actually Do)
The short version
- You don't need an enterprise budget — a focused checklist of basics closes the large majority of real cybersecurity risk.
- The essentials: strong passwords with MFA, regular updates, tested backups, a firewall and protected devices, email/phishing awareness, and secure remote access.
- Most of these are cheap or free — the value is in doing them consistently, not in buying expensive tools.
- Work top-down: the items near the top stop the most common attacks, so start there and don't get distracted by the fancy stuff.
Short answer: You don't need an enterprise budget — a focused checklist of basics closes the large majority of real cybersecurity risk. The essentials: strong passwords with MFA, regular updates, tested backups, a firewall and protected devices, email/phishing awareness, and secure remote access. Most are cheap or free; the value is doing them consistently. Work top-down — the items near the top stop the most common attacks, so start there.
Cybersecurity can feel overwhelming for a small business — endless products, scary headlines, no clear starting point. So here's the antidote: a plain, prioritised checklist of what actually matters. Do these, top-down, and you'll have closed the doors most attacks come through — no enterprise budget required. (This pulls together everything in our managed IT and security guides.)
1. Passwords + MFA (start here)
The single biggest win. Use a password manager so every account has a strong, unique password, and turn on multi-factor authentication (MFA) everywhere it's offered. Most breaches start with a stolen or reused password — this shuts that down. → Business password security
2. Keep everything updated
Turn on automatic updates for software and devices, and retire anything no longer supported. Unpatched software is the most common technical way in, and updating is mostly free. → Why software updates matter
3. Back up your data (and test it)
Follow the 3-2-1 rule — three copies, two types of storage, one offsite — make it automatic, and test that it restores. This is your safety net against ransomware, hardware failure, and mistakes. → Data backup for small business
4. Protect your network and devices
A proper firewall, secure Wi-Fi with a separate guest network, and endpoint protection (modern antivirus) on every device. The perimeter and the machines, both covered. → Network security basics · Security tools you need
5. Defend against phishing
Add email filtering, and — just as important — train your team to spot phishing and to verify any money or password request through a second channel. People are the deciding layer. → How to spot a phishing email
6. Secure remote and personal devices
If anyone works remotely, use a VPN on untrusted networks, require device updates and encryption, and set a clear rule for personal devices. Your security perimeter now extends wherever your people work. → Remote work security
7. Control access
Give people their own logins, grant only the access each role needs, and remove access promptly when someone leaves. The fewer keys floating around, the smaller your exposure.
How to use this list
Don't try to do it all at once — work top-down. The first three items (passwords/MFA, updates, backups) stop the most common attacks and cost almost nothing, so nail those first. Then steadily work down. Doing the top few properly beats doing all seven half-heartedly.
The bottom line
Small business cybersecurity isn't about an enterprise budget or a wall of products — it's this short checklist done consistently: passwords and MFA, updates, tested backups, network and device protection, phishing defence, secure remote access, and access control. Most of it is cheap or free; the value is in actually doing it and keeping it going. Work top-down, get the basics right, and you've closed the doors most attacks use — and if you'd rather have the whole list handled for you, that's exactly what we do.
Frequently asked questions
What should be on a small business cybersecurity checklist?
The essentials: use strong, unique passwords with multi-factor authentication; keep all software and devices updated; take regular, tested backups; use a firewall and endpoint protection; filter email and train staff to spot phishing; secure remote and personal-device access; and control who can access what. Done consistently, those cover the large majority of real-world risk.
Where should a small business start with cybersecurity?
Start at the top of the list: turn on multi-factor authentication everywhere, get a password manager in use, and make sure software updates are happening automatically. Those three stop the most common attacks (stolen passwords and unpatched flaws) and cost little to nothing. Once they're solid, work down to backups, devices, and the rest.
How much does it cost to secure a small business?
Less than most fear — many of the most important steps (MFA, updates, strong passwords, staff awareness) are free or nearly free. The real cost is the time and consistency to set them up properly and keep them going, which is why many businesses hand it to managed IT. Spend on the basics done well, not on expensive tools left unconfigured.
Do I need to do everything on the checklist at once?
No — work top-down. The items near the top stop the most common attacks, so getting those right first gives you the biggest risk reduction fastest. Then steadily work down the list. Doing the top few properly beats doing all of them half-heartedly.
Can a small business handle this checklist alone?
Many of the basics you can do yourself — enabling MFA, using a password manager, keeping things updated. The parts worth professional help are verifying it's all actually configured correctly, that backups truly restore, and that nothing's quietly exposed. The everyday habits you can own; the assurance is worth outsourcing.
Want this whole checklist just handled? That's what we do — we set up and manage every item here across your business, keep it current, and watch for trouble, on a simple monthly plan. You get the protection without the homework.