Small Business Cybersecurity Checklist (2026): 20 Essentials

Last updated: October 2026

Disclosure: This checklist is based on hands-on IT and security work with small businesses. It contains no paid placements. Some linked guides may include affiliate links; see our Affiliate Disclosure and Editorial Policy.

Most cyberattacks on small businesses are not sophisticated. They succeed because of a reused password, a missing update, an email nobody checked, or an old IT provider who still has access. The good news is that a short list of basics blocks most of them.

This checklist covers the 20 security basics every small business should have in place, grouped into seven areas. Work through it in order: the first sections give the biggest protection for the least effort. Each item links to a detailed guide where we have one.

How to use this checklist

• Tick each item as Done, Partly done or Not done.
• Fix the “Not done” items in the first two sections first.
• Review the whole list every six months, and whenever you change IT provider, hire or lose staff, or add a new system.

1. Accounts and passwords (start here)

Stolen or guessed passwords are behind a large share of breaches. These four items close most of that risk.

1. Turn on multi-factor authentication (MFA) everywhere. Email, Microsoft 365 or Google Workspace, banking, accounting software, your website and your domain registrar. Use an authenticator app rather than SMS where you can.
2. Use a business password manager. Every account gets a unique, strong password, shared logins are stored securely, and access is removed in one click when someone leaves. See our comparison of the best password managers for small business.
3. Separate admin accounts from everyday accounts. Nobody should read email or browse the web while signed in as an administrator.
4. Remove leavers the same day. Disable accounts, change shared passwords and recover devices on an employee’s last day.

2. Email security

Email is how most attacks start, and the main route for invoice fraud.

5. Set up SPF, DKIM and DMARC, and move DMARC to p=reject so criminals cannot send email as your domain. Follow our DMARC setup guide.
6. Turn on spoofing and phishing protection for incoming email, including external-sender tags. See how to stop email spoofing.
7. Block automatic forwarding of email to outside addresses, a common trick after an account is taken over.
8. Verify payment and bank-detail changes by phone, using a number you already have.

3. Devices: computers, laptops and phones

9. Keep everything updated. Turn on automatic updates for Windows, macOS, browsers and common apps, and replace devices that no longer receive security updates.
10. Use endpoint protection on every computer. At minimum, keep Microsoft Defender switched on and monitored; growing businesses benefit from a managed business endpoint product.
11. Encrypt laptops. Turn on BitLocker (Windows) or FileVault (Mac) so a lost or stolen laptop does not mean lost data.
12. Remove local admin rights from everyday users, so malware cannot install itself as easily.

4. Remote access and IT providers

13. Know every remote-access tool installed on your computers. Remote-management agents and tools such as AnyDesk or TeamViewer should only exist if your business controls them.
14. Offboard IT providers properly. When you change provider, remove their remote tools, admin accounts and passwords on day one. Read our real case of a former IT provider who still had access to every PC to see why this matters.
15. Own your key accounts. Your business, not a provider, should own the Microsoft 365 or Google Workspace tenant, the domain name and the firewall login. See our Microsoft 365 security settings guide.

5. Network and Wi-Fi

16. Secure the firewall and router. Change default passwords, keep firmware updated and disable remote management you don’t use.
17. Separate guest Wi-Fi from the network your business computers use, and use WPA2 or WPA3 with a strong password.

6. Backup and recovery

18. Follow the 3-2-1 backup rule: three copies of important data, on two types of storage, with one copy off-site or in the cloud. Include Microsoft 365 or Google Workspace data, which many businesses wrongly assume is fully backed up.
19. Test a restore at least every three months. A backup you have never restored is a hope, not a plan.

7. People and plans

20. Train staff and write a simple incident plan. Run short phishing-awareness sessions a few times a year, and write one page that says who to call and what to do if something goes wrong: an IT contact, your bank, and how to disconnect an affected computer.

Printable summary

Area	Must-have items
Accounts and passwords	MFA everywhere, password manager, separate admin accounts, same-day leaver removal
Email	SPF/DKIM/DMARC at reject, phishing and spoofing protection, block auto-forwarding, phone-verify payments
Devices	Automatic updates, endpoint protection, encryption, no local admin rights
Remote access	Know every remote tool, offboard IT providers, own your key accounts
Network	Secure firewall and router, separate guest Wi-Fi
Backup	3-2-1 backups including cloud email, quarterly restore tests
People	Regular training, one-page incident plan

Where to start if you only have one day

If you can only do a few things this week, do these:

1. Turn on MFA for email and banking.
2. Check your DMARC record, and set one up if it is missing.
3. Make sure computers are updating automatically.
4. Confirm you have a recent backup, and restore one file to prove it works.
5. Check that no former IT provider or employee still has access.

Frequently asked questions

How much should a small business spend on cybersecurity? There is no single figure, but most of this checklist costs little or nothing beyond time: MFA, updates, DMARC and backups of key data. The main paid items are a password manager, endpoint protection and backup software, typically a few dollars per user per month each.

Do small businesses really get targeted? Yes. Attackers use automated tools that target any business with weak passwords, unpatched systems or unprotected email. Small businesses are often easier targets than large companies.

Do I need an IT provider to do this? Many items can be done in-house by a confident person. An IT provider helps with firewalls, endpoint management and backups, but make sure your business keeps ownership of its accounts.

How often should I review this checklist? Every six months, and after any big change: a new IT provider, new systems, or staff changes.

Related guides

• Best backup solutions for small business
• 1Password vs Bitwarden vs NordPass vs Keeper for business
• DMARC policy explained: none vs quarantine vs reject

We update this checklist as new guides are published. Last reviewed October 2026.