October is Cybersecurity Awareness Month, and we’d like to kick it off with something useful. So here’s a small business security checklist you can finish in about 30 minutes. No consultants, no jargon, and no 80-page policy binder.
This year’s theme from the National Cybersecurity Alliance is “Don’t Make It Easy for Them”. We love that framing. After all, most break-ins happen because someone left a door unlocked, not because a movie villain cracked a vault.
Why small offices need a checklist too
Many owners assume hackers only chase big companies. Unfortunately, automated attacks don’t check your headcount first. They simply scan for weak passwords, old software and careless clicks.
Meanwhile, a five-person office rarely has a full-time IT person watching the gate. That’s exactly why a short small business security checklist works so well. It turns a vague worry into a list of specific yes-or-no questions.
How to use this small business security checklist
Grab a coffee, a notepad and whoever handles “the computer stuff” in your office. Then work through the six blocks below. Each one takes about five minutes.
Don’t fix everything today. Instead, mark each item as done, needs work, or no idea. The “no idea” answers are often the most valuable part.
Minutes 0–5: Lock down your logins
Stolen passwords are the easiest way into a small business. As a result, this block comes first.
- Is multi-factor authentication on for email, Microsoft 365 or Google Workspace, banking and payroll?
- Does the team use a password manager instead of sticky notes and spreadsheets?
- Are any logins shared by several people? If so, write them down.
- Did former employees lose access the day they left?
If MFA isn’t everywhere yet, start with email. Our guide to multi-factor authentication for small businesses walks through the rollout in plain English.
Minutes 5–10: Check updates on every device
Old software is like a house with a broken window latch. Burglars know exactly which models to look for.
- Are automatic updates on for Windows, macOS, phones and web browsers?
- Is any computer still running an operating system that no longer gets security fixes?
- When did the router, firewall and Wi-Fi gear last get a firmware update?
- Is antivirus actually running on every PC, not just installed?
The FTC’s cybersecurity basics for small businesses recommend keeping apps, browsers and operating systems updated on a schedule. We agree, and we’d add network gear to that list.
Minutes 10–15: Test your backups
Here’s our honest pushback: a backup you’ve never restored is really just a hope. Ransomware, a dead laptop or a bad click can all wipe out files in seconds.
- Where do your important files live, and who can name every location?
- Is there a copy that ransomware can’t reach, such as offline or versioned cloud backup?
- Can you restore one file right now? Try it before you move on.
Keep in mind that OneDrive or Google Drive sync alone isn’t a full backup. If a file gets encrypted or deleted, sync can copy that damage everywhere.
Minutes 15–20: Protect the money
Criminals don’t always need malware. Sometimes they just need one convincing email to your bookkeeper.
- Do you have a written rule for verifying new or changed payment instructions?
- Does that rule require a phone call to a number you already have on file?
- Are bank alerts turned on for wires, ACH transfers and new payees?
That call-back rule sounds almost too simple. Yet it’s exactly what saved the day in our story about a five-minute phone call that stopped a wire fraud.
Minutes 20–25: Look at the network
Next, walk over to the closet with the blinking lights. You don’t need to understand every box to spot trouble.
- Is guest Wi-Fi separate from the network your business computers use?
- Is Wi-Fi using WPA2 or WPA3 encryption, as the FTC recommends?
- Did anyone change the default admin passwords on the router and cameras?
- Does someone actually know how to log in to manage this equipment?
Minutes 25–30: Train people and plan ahead
Finally, the human side. Your team is either your best alarm system or your weakest lock.
- Does everyone know how to report a suspicious email without feeling embarrassed?
- Has the team had any phishing awareness training in the last year?
- If ransomware hit tomorrow, who would you call first? Write that name down.
That last question often ends with a long pause. However, a one-page plan with names and phone numbers beats panic every time.
What to do with your small business security checklist results
Now look at your notes. Most offices end up with a short pile of “needs work” and a few scary “no idea” answers. That’s normal, so don’t panic.
- Fix logins first. MFA on email and banking gives the biggest return for the least effort.
- Then prove backups work. A tested restore turns a disaster into an inconvenience.
- Schedule the rest. Put one item per week on the calendar through October.
Repeat this small business security checklist every quarter. Because offices change constantly, new hires, new laptops and new apps quietly open new gaps.
Want us to run the checklist with you?
Some items on this small business security checklist are easy to answer. Others, like firewall settings and backup coverage, are tough to judge from the outside. That’s where a second set of eyes helps.
Our business IT support team works with offices across Nashville, Franklin and Brentwood. Contact us for a free security assessment, and we’ll help you turn “no idea” into “done”.