Business Cybersecurity Checklist for Small Teams (2026)

Most cybersecurity advice for small businesses is either terrifying or unusable — a wall of jargon that assumes you have an IT team to action it. You don’t, so this checklist is built differently. It’s the baseline I’d actually implement for a small business with no IT department, in priority order, in plain English. Do these things consistently and you’ll shut out the overwhelming majority of attacks that hit businesses your size.

You don’t need a big budget or a security background. You need to do a small number of basics, and keep doing them.

Why small businesses are targets

The “we’re too small to be a target” belief is exactly why small businesses get hit. Attackers favour small businesses precisely because the security basics are often missing — and most attacks aren’t personal, they’re automated, scanning for any easy way in. Ransomware in particular disproportionately targets smaller organisations, because they tend to have weaker defences and can’t absorb downtime, which makes them more likely to pay.

The good news: because these attacks go for the easy targets, doing the basics moves you out of that group. You don’t have to be unbreakable — just harder than the next business along.

It’s also worth being honest about the stakes, because “it won’t happen to us” is the belief this whole checklist exists to fix. The reality for a small business isn’t a dramatic, targeted hack — it’s an employee clicking a convincing invoice, a reused password turning up in a leak, or ransomware encrypting the one folder nobody backed up. Any of those can mean days of lost work, lost customer trust, and real money to recover. The reason to do the basics isn’t paranoia; it’s that the downside is genuinely large and the fixes are genuinely small.

The 8-point security baseline

Here’s the whole baseline at a glance. The rest of the article works through each one. Tackle them top-down — they’re in priority order.

• Turn on multi-factor authentication (MFA)
• Use a password manager
• Back up your data (and test it)
• Keep everything updated
• Protect every device
• Train the team on phishing
• Control access (joiners and leavers)
• Know your incident plan

1. Turn on multi-factor authentication

This is the single highest-impact thing on the list, and it’s free. Even if a password is stolen — and assume one will be — MFA usually blocks the login. Enable it on your email first (that’s the master key to everything else), then every account that supports it: banking, your Microsoft 365 or Google Workspace admin, and your most-used apps.

One practical note: an authenticator app or a hardware key is meaningfully safer than SMS codes, which can be intercepted by SIM-swap attacks. Steer people to an app where you can.

2. Use a password manager

Reused and shared passwords are how small businesses get breached. One leaked password becomes a master key when the same one unlocks five accounts. A password manager generates strong, unique passwords for everything and lets your team share access safely — no more credentials in spreadsheets, sticky notes, or email threads.

It’s a few dollars per user per month and removes an entire category of risk. My current pick: NordPass.

A rollout tip from doing this repeatedly: don’t try to move every password at once or the team will give up. Start by adding new accounts to the manager as they come up, then migrate the handful of critical shared logins (email, banking, your main systems), and let the rest follow naturally. Within a few weeks it becomes the default, and the spreadsheet of passwords quietly disappears.

3. Back up your data — and test it

Backups are your last line of defence against ransomware and human error. Follow the 3-2-1 rule: three copies, on two types of storage, with one off-site (cloud counts). And know this clearly: Microsoft 365 and Google Workspace are not a backup. They sync and keep deleted items briefly, but they won’t save you from ransomware, corruption, or a compromised account being emptied past the retention window.

Use a proper third-party backup for your email and cloud files — IDrive — and run one test restore so you know it works before you need it. A backup you’ve never tested is just hope.

4. Keep everything updated

Most breaches exploit known vulnerabilities that a patch already fixed. Turn on automatic updates for operating systems, browsers, and apps across every device, and you close those holes without lifting a finger. It’s the laziest high-value security habit there is.

The gaps people forget are the ones that aren’t the operating system: web browsers and their extensions, the apps you installed once and never think about, router and firewall firmware, and phones used for work email. Set everything you can to update automatically, and put a recurring note in the calendar to check the handful of things that can’t. An unpatched router or an abandoned browser extension is exactly the kind of quiet hole attackers scan for.

5. Protect every device

Every machine that touches business data needs reputable, up-to-date endpoint protection. The built-in options are far better than they used to be and are fine for many small businesses; if you want a paid alternative with central management, compare options in our best antivirus software guide — ESET Small Business Security is a solid pick. Also retire devices older than about five years; once they stop getting security updates, they become your weakest link.

6. Train the team on phishing

Technology stops a lot, but the human is now the target. A 20-minute conversation about how to spot a suspicious email — unexpected urgency, mismatched links, requests to change payment details — prevents more damage than most paid tools. Make it normal to pause and verify, and normal to report a mistake without blame. Our guide on protecting your business from phishing gives you the talking points.

One scenario worth naming specifically, because it hits small businesses hard: the fake invoice or “please update our bank details” email, often appearing to come from a supplier or even the owner. The fix is a simple rule everyone follows — any change to payment details is verified by a phone call to a known number, never by replying to the email. That one habit prevents the single most expensive type of small-business scam, and it costs nothing.

7. Control access: joiners and leavers

Everyone gets their own account — no shared logins, ever, because you can’t cleanly revoke access to a shared account when someone leaves. Have a simple, written process for adding a new person (right access, no more) and, just as importantly, for removing access the day someone departs. Disable old and unused accounts; they’re a quiet open door.

8. Know your incident plan

You don’t need a 40-page document. You need to know, in advance, the first few moves if something goes wrong: disconnect the affected device, change the relevant passwords, check your backups, and know who to call. Writing down even half a page now saves panic later.

Keep that half-page somewhere you can reach it even if your systems are down — printed, or in a personal account separate from the business. A plan saved only inside the email account that just got locked isn’t much use. Include key contacts (your bank, your insurer if you have cyber cover, any consultant), and decide in advance who makes the call to shut things down. In a real incident, the businesses that recover well aren’t the ones with the fanciest tools — they’re the ones who knew their first five moves.

How I’d prioritise this for a small team

Supporting small business environments, I almost never start at the bottom of a list like this. If I’m handed a business with nothing in place, the order is always the same: MFA first (free, stops most account takeovers), then a password manager, then a real backup. Those three alone remove the bulk of the actual risk in a typical small business, and none of them is expensive or technical. Everything else is important, but it’s refinement on top of those foundations. So if this list feels like a lot, just do the first three this week — you’ll have closed most of the gap.

Make security a habit: a 15-minute quarterly review

Security isn’t a one-time project — it drifts. New people join, tools get added, someone turns off a setting “just for now.” Four times a year, block 15 minutes and run a quick check: is MFA still on everywhere, are leavers’ accounts disabled, are backups running and have you done a test restore this quarter, is anything overdue for updates, and has any new tool slipped in without security review? That short habit catches the slow erosion that turns a secure setup into a vulnerable one — and it’s far easier than reacting to an incident.

Download the security checklist

Want this as a printable checklist you can tick off — plus a password/MFA tracker and a backup checklist? It’s all in our free Small Business Technology Checklist workbook.

Frequently asked questions

What is the most important cybersecurity step for a small business?

Turning on multi-factor authentication. It’s free, takes minutes, and blocks the large majority of account-takeover attacks even when a password has been stolen. Do it on email first.

How much does small business cybersecurity cost?

Less than most owners expect. The biggest wins — MFA and updates — are free. A password manager and a backup service are each a few dollars per user per month. Good security is mostly consistency, not spend.

Is Microsoft 365 enough to protect my business?

It’s a strong start when its security features are switched on, but it isn’t a complete solution — and it’s not a backup. You still need MFA configured, a password manager, endpoint protection, and a separate third-party backup.

Do small businesses really get targeted by hackers?

Yes — often more than large ones, because their defences are weaker. Most attacks are automated and opportunistic, not personal, which is exactly why doing the basics moves you out of the easy-target pool.

What should I do first if I’ve been breached?

Disconnect the affected device from the network, change passwords on the impacted accounts (from a clean device), check your backups, and contact anyone who can help. Acting in the first hour limits the damage.