Small Business Cybersecurity Checklist: The 12 Controls You Need in 2026
If you run a small business, you do not need an enterprise security department. You need a short list of controls done properly. This checklist is the minimum viable security setup for a business with 5–150 people and no full-time security staff, ordered so the highest-impact items come first. Work through it over a few weeks; each item takes between 15 minutes and a few hours.
1. Turn on multi-factor authentication (MFA) everywhere
MFA is the single highest-value change most businesses can make. Start with email — whoever controls the email inbox can reset almost every other password. Then cover banking, accounting, your Microsoft 365 or Google Workspace admin accounts, and social media. Prefer an authenticator app or hardware key over SMS codes, which can be intercepted. Industry data consistently shows MFA blocks the overwhelming majority of automated account-takeover attacks.
2. Give every employee a password manager
Reused passwords are how one leaked password becomes a full compromise. A business password manager generates and stores a unique password for every account, lets you share logins safely inside the team, and — critically — lets you revoke access the day someone leaves. See our guide to choosing the best password manager for a small business.
3. Automate updates and patching
Exploiting known software vulnerabilities is now one of the top ways attackers get in, and it works because businesses delay updates. Turn on automatic updates for operating systems, browsers, office software and line-of-business apps. Keep a simple list of every device and check monthly that nothing has fallen behind.
4. Back up automatically — and test the restore
A backup you have never restored is a hope, not a plan. Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy off-site or in the cloud. Make at least one copy immutable or offline so ransomware cannot encrypt it too, and test a real restore every quarter. This is the core of ransomware protection for a small business.
5. Put real endpoint protection on every device
Built-in antivirus is a start, but modern attacks need endpoint detection and response (EDR), which watches behaviour, not just known virus signatures, and can isolate an infected machine automatically. Whatever you choose, it must cover every laptop, desktop and server — including the owner's personal laptop used for work.
6. Filter email and defend against phishing
Most breaches begin with an email. Turn on your platform's advanced phishing protection, add an external-sender warning banner, and block automatic forwarding to outside addresses — a classic sign of a compromised mailbox. Then read our full guide on how to prevent phishing attacks.
7. Train your people, briefly and often
Short, regular awareness beats one long annual session. Teach three habits: check the sender before acting, never approve an MFA prompt you did not trigger, and verify any change to bank details or payment instructions by calling a known number. Run a five-minute example in team meetings once a month.
8. Apply least-privilege access
Not everyone needs admin rights or access to every folder. Give each person the minimum access their job needs, use separate admin accounts for IT tasks, and review access quarterly. When one account is compromised, least privilege is what stops it becoming everything.
9. Secure remote and home working
Remote staff should connect through a VPN or zero-trust access, never exposed remote-desktop ports. Home routers need current firmware and a changed default password. Require device lock screens and disk encryption on laptops that leave the office.
10. Lock down your Wi-Fi and network basics
Change default router credentials, use WPA3 (or WPA2) with a strong passphrase, keep a separate guest network for visitors and smart devices, and make sure your firewall is actually enabled and updated.
11. Write a one-page incident response plan
Decide now, calmly, what you will do in the first hour of an incident: who isolates machines, who calls your IT provider, who contacts the bank, and who communicates with customers. Store it on paper as well as digitally — you may not have system access when you need it.
12. Review, insure and repeat
Security is a routine, not a project. Put a monthly 30-minute review on the calendar: check MFA coverage, backup test results, patch status and leavers' accounts. Consider cyber insurance as a financial backstop — insurers will ask about most items on this list, which is another reason to complete it. Wondering what all this should cost? See how much cybersecurity costs for a small business.
Frequently asked questions
What is the first thing a small business should do for cybersecurity?
Enable MFA on email and admin accounts, then deploy a password manager. Together they close the most common entry point — stolen credentials — in a single afternoon.
How often should we review this checklist?
Review monthly in a short meeting and re-run the full checklist every quarter or whenever you add staff, software or a new location.
Keep reading: the small business cybersecurity checklist · how to prevent phishing attacks · ransomware protection for small business