The Small Business Cybersecurity Checklist

Most cybersecurity checklists try to cover everything at once, which makes them overwhelming and easy to ignore. This one is organized by priority — start at the top, and each section builds toward a more mature security posture without requiring you to do it all in one weekend.

Tier 1: Do these first (highest impact, lowest lift)

• Enable multifactor authentication (MFA) on email, remote access, and any system holding financial or customer data.
• Use a business password manager so employees stop reusing and writing down passwords.
• Turn on automatic updates for operating systems and browsers, at minimum.
• Isolate backups from your main network — ideally with at least one copy that ransomware physically cannot reach.
• Restrict admin rights to only the people who genuinely need them.

Tier 2: Build on the foundation

• Deploy endpoint detection and response (EDR) in place of, or alongside, traditional antivirus.
• Set up email authentication — SPF, DKIM, and DMARC — to reduce spoofing of your domain.
• Run employee security awareness training at least annually, with phishing simulations if possible.
• Document an incident response plan — who gets called, in what order, if something goes wrong.
• Review third-party and vendor access quarterly, and remove what's no longer needed.

Tier 3: Formalize and monitor

• Move toward zero trust principles — verify every access request rather than trusting anything by default just because it's inside the network.
• Add 24/7 monitoring (MDR/SOC-as-a-Service) so alerts actually get reviewed, not just generated.
• Map your controls against a framework relevant to your industry — NIST 800-53, CIS Benchmarks, or a compliance-specific standard like HIPAA or PCI DSS.
• Test your backups with an actual restore, not just a "backup completed successfully" notification.
• Revisit your cyber insurance policy annually to confirm your controls still match what's required.

How to use this list

If you're starting from zero, Tier 1 alone meaningfully reduces your risk of the most common attacks — credential theft, ransomware, and basic phishing. Tiers 2 and 3 are where a business moves from "reasonably protected" to genuinely resilient, and where the returns from having a real IT/security function — rather than handling this reactively — become obvious.