If you run a small business without a full-time IT team, cybersecurity can feel like a list that never ends. Start with the systems your staff need every day, the accounts that control them, and what would happen if something stopped working.

This small business cybersecurity checklist gives you eight practical checks. Each includes an action, a question to ask your IT provider, and a way to recognize progress. Choose one item today rather than trying to finish everything at once.

If you suspect an active attack, fraudulent payment, or exposed sensitive information, contact your IT provider and business incident lead promptly. Do not wait to work through this article.

The checklist at a glance

  • Name your important systems and who looks after them.
  • Protect business accounts with safer sign-in and unique passwords.
  • Keep devices and software supported and updated.
  • Check backups by testing that data can be restored.
  • Review access when employees, contractors, or roles change.
  • Give staff clear reporting and payment-verification rules.
  • Keep verified incident contacts available outside company email.
  • Identify the customer, insurance, and legal requirements you need to investigate.

Use Not checked, Needs work, or Verified for each item. “Our provider probably handles it” is a question to resolve, not a completed check. Keep evidence restricted and leave passwords and recovery codes out of the record.

1. Know your important systems and their owners

Do this: List three services your business would struggle to operate without. Email, shared files, accounting, scheduling, and customer records are common examples. Record what information each holds, its business owner, and the provider or person who supports it.

Ask your provider: “Which systems and business devices do you manage, what is excluded, and who should we contact when something fails?”

Check progress: You can name an accountable person and support contact for each critical service. Include services bought separately by a department, not just those on your main IT invoice.

For example, the office manager may own the scheduling process while an external provider manages its technical settings. Both responsibilities should be clear.

2. Protect email and administrator accounts

Do this: Ask your provider to verify an extra sign-in check on email, administrator accounts, and other important services. This is called multifactor authentication, or MFA. Prefer phishing-resistant options such as passkeys or security keys where supported. Use unique passwords stored in an approved password manager rather than reusing them across services.

Ask your provider: “Which accounts actually require MFA, how is account recovery protected, and which services need an alternative safeguard?”

Check progress: Get a current coverage summary and confirmation that authorized users can recover access. A written requirement or a registration invitation does not prove that every account is protected. Plan changes with your provider to avoid locking the business out.

CISA’s MFA guidance for businesses explains the additional sign-in protection and recommends phishing-resistant methods.

3. Keep business devices and software updated

Do this: Check that laptops, phones, business applications, and network equipment still receive security updates. Use automatic updates where suitable and have your provider schedule and verify changes that need testing or downtime. Keep device locking, encryption, and approved security protection enabled.

Ask your provider: “What is unsupported or behind on security updates, who checks failures, and what is the plan for the highest-risk gaps?”

Check progress: There is an owner for updates and a record of unresolved items with target dates. “Updates are enabled” is less useful than knowing whether they installed successfully. Do not apply unfamiliar firmware or production-system changes without appropriate help.

4. Find out whether your backups are usable

Do this: Confirm which important data is backed up, what is excluded, and when someone last tested getting it back. Ask how backup copies are protected against deletion or compromise. Cloud storage and file synchronization alone do not establish an independent recovery arrangement.

Ask your provider: “Can you show the latest successful restore result, including what was tested, how long it took, and any limitations?”

Check progress: A representative restore has been validated, or a missing test has a named owner and date. An assigned test is an open action, not proof of recovery. A successful backup job alone does not show that the right files and permissions can be restored.

Use our guide to checking business backups to plan a safe sample test. Restore to a separate controlled destination; do not delete or overwrite live business data to test a backup.

5. Check who still has access

Do this: Have managers confirm who needs access to important systems. Include contractors, suppliers, shared folders, and separately managed applications. Give each worker an individual account and limit permissions to their work. Coordinate removal at an approved time when someone leaves, and review access after role changes.

Ask your provider: “Do we have accounts for people who no longer need access, and how do we verify removal across separate applications and existing sign-in sessions?”

Check progress: A dated review records the decisions and completed changes. Preserve required records and transfer ownership before deleting accounts. Do not assume turning off email removes access everywhere.

Our employee IT offboarding checklist covers departure timing, files, sessions, shared passwords, and devices in more detail.

6. Give staff two clear everyday rules

Do this: Show staff how to report suspicious messages, unexpected sign-in prompts, lost devices, or accidental disclosures. Also require independent verification of payment-detail changes through a previously known contact and the business’s approval process.

Ask your provider: “What is our reporting channel, who watches it, and what should staff do if company email may be compromised?”

Check progress: Ask a worker to explain where they would report an unexpected MFA prompt or how they would verify a supplier’s new bank details. Demonstrated understanding tells you more than a signed acknowledgment alone. Encourage early reporting even when someone has made a mistake.

7. Know who to call when something goes wrong

Do this: Name a business incident lead, a deputy, and an IT escalation contact. Verify phone numbers, support hours, and what the provider’s agreement covers. Keep a protected copy available if company email or shared storage is unavailable.

Ask your provider: “Who can help during an incident, what decisions need our approval, and what is the fallback if our usual contact is away?”

Check progress: The deputy can find the contacts without relying on the affected email account. Talk through a short example, such as a suspected compromised mailbox, and record any missing contacts or unclear responsibilities. Do not send a real fraudulent message to create an exercise.

8. Check which requirements apply to your business

Do this: Gather customer security commitments, insurance conditions, and questions about the information you handle. Ask an appropriate adviser to determine applicable legal and regulatory obligations. Requirements depend on your location, activities, contracts, and data; there is no universal small business compliance certificate.

Ask your provider and adviser: “Which obligations are confirmed, what evidence do we need, and which questions still require specialist review?”

Check progress: Keep a short register with the source, scope, responsible reviewer, deadline, and next action. Mark uncertain requirements as unresolved rather than assuming they do not apply.

If a customer has already sent questions, read how to handle a small business security questionnaire. Answer from current evidence rather than treating this checklist as proof of compliance.

What should you do first?

Choose the most important unanswered question, name an owner, and arrange the next check. Missing protection on business email or administrator accounts, access for a departed worker, and failed critical backups deserve prompt attention. Known incidents and binding deadlines take priority over this suggested order.

For a business with several employees and an external provider, a manageable first meeting could cover three things: confirm email sign-in protection, request the latest restore result, and review access for recent leavers. Record what is verified and what still needs work. That is useful progress even before you adopt formal policies.

A message you can send today

We are checking our basic IT safeguards. Please help us confirm who manages our critical systems, MFA coverage, unsupported software, backup restore results, and access for former workers. For any gaps, please identify the affected system, next action, owner, and expected cost or timing. Please do not include passwords or recovery codes in the response.

You can then use short check-ins to close the gaps, train staff, and introduce policies that match actual practice. The goal is a working foundation, not a folder of completed paperwork.

Is a cybersecurity checklist the same as IT compliance?

No. This is an IT security starting checklist, not a complete assessment or a legal compliance determination. It covers useful first safeguards, but your business may need additional controls, records, testing, or independent review. Use it to organize the work and identify where qualified help is needed.

Further reading

The sequence, provider questions, and completion checks in this article are suggested practices, not an official checklist issued or endorsed by those organizations. General operational guidance; not legal advice or a guarantee of security.