Small Business Cybersecurity Checklist

List the applications, devices and information needed to serve customers, pay staff and keep records. Name the person responsible for each.

Evidence to look for: A dated service list with named owners.

Check active staff, administrator and supplier accounts. Remove access that is no longer needed through your normal approval process.

Evidence to look for: An access review and a record of agreed changes.

Prioritize multi-factor authentication for business email, administration and other important services. Confirm how each account can be recovered.

Evidence to look for: An MFA coverage list with exceptions assigned to an owner.

Agree who monitors vendor updates, deploys relevant security fixes and checks completion. Record a plan for unsupported devices or software.

Evidence to look for: An update report and an exception list.

Confirm that business devices have supported security protection and that alerts reach someone who can respond.

Evidence to look for: A current device-protection status report.

Use ordinary accounts for everyday work. Reserve administrator access for approved tasks and protect those accounts separately.

Evidence to look for: A list of administrative accounts and their owners.

Confirm which business information is covered, including relevant cloud services. Set a backup frequency that fits how quickly the information changes.

Evidence to look for: A backup scope and schedule agreed by the business.

Plan an authorized test using a separate location or test environment. Recover a sample and confirm it can be opened without replacing live information.

Evidence to look for: A dated restore result and a record of any gaps.

Tell staff how to report suspicious messages or unexpected sign-in requests. Provide a trusted contact method they can find quickly.

Evidence to look for: A reporting instruction shared with the team.

Record who coordinates an incident and how to reach IT support and other relevant partners if normal systems are unavailable.

Evidence to look for: An accessible contact sheet with a review date.

Ask important cloud and IT suppliers who handles updates, backups, account recovery and incident communication. Record the boundaries of your own responsibilities.

Evidence to look for: A responsibility summary for critical services.

Select three unresolved items, assign an owner and target date, and agree when progress will be reviewed.

Evidence to look for: A short action plan with owners and dates.