The Small Business Cybersecurity Checklist: 25 Controls That Actually Matter in 2026

This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.

A small business cybersecurity checklist should cover six things: who is responsible, what you have, how you protect it, how you notice problems, how you respond, and how you recover. In practice the highest-impact controls are multi-factor authentication on every important account, a team password manager, automatic updates, email authentication, tested backups and a one-page incident plan. Most of these cost little or nothing.

The checklist below is organized around NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide, so it scales as you grow instead of being a random list of tips.

This is general information, not legal or professional security advice. Businesses in regulated sectors such as health or finance have additional obligations.

Key takeaways

• Email and identity come first. Business email compromise caused over $3 billion in reported losses in 2025, according to the FBI.
• Turn on what you already own. Microsoft security defaults and Google Workspace 2-Step Verification are free with the platform.
• Passwords: long, unique, and in a manager. NIST now says not to force periodic password changes or composition rules.
• Backups only count if you can restore them. Keep at least one copy offline or immutable, and test restores.
• Write the incident plan before you need it. One page with names, phone numbers and first steps beats a 40-page policy nobody reads.

Why small businesses need a checklist now

The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with $20.877 billion in reported losses, a 26 percent increase over 2024. Phishing and spoofing was the most reported crime type with 191,561 complaints, and business email compromise produced $3.05 billion in losses. These are reported figures only; many incidents never reach the FBI.

Attackers rarely need advanced techniques against small businesses. A reused password, an unpatched plugin or one convincing invoice email is usually enough.

The checklist, organized by NIST CSF 2.0 function

Govern: decide who owns security

1. Name one owner for cybersecurity, even if it is the founder. Give them authority to enforce the basics.
2. Write a one-page security policy covering MFA, password manager use, device updates, approved apps and how to report incidents.
3. Know your obligations. Identify what laws and contracts apply: card data (PCI DSS), health data, customer contracts and data breach notification laws where your customers live.
4. Vet vendors that hold your data: ask about MFA, encryption, backups and breach notification.

Identify: know what you have

5. List your critical accounts: email, domain registrar, DNS, banking, payroll, cloud storage, e-commerce, accounting, social media.
6. List your devices and who uses them, including personal phones that access work email.
7. List your sensitive data and where it lives: customer records, payment details, employee files, contracts.
8. Map who has admin access to each system, and remove anyone who doesn't need it.

Protect: put safeguards in place

9. Enforce MFA everywhere it is offered, starting with email, banking, domain registrar and admin accounts. CISA recommends businesses aim for phishing-resistant MFA, such as passkeys or security keys.
10. Deploy a team password manager and require unique passwords. CISA recommends passwords of at least 16 characters or a passphrase of five to seven unrelated words.
11. Follow modern password rules. NIST SP 800-63B-4 says systems should require at least 15 characters for password-only logins, should not force periodic changes, and should block known breached passwords.
12. Turn on automatic updates for operating systems, browsers, apps, plugins and firmware.
13. Use separate admin accounts for administration and normal accounts for daily work. Google's checklist specifically advises super admins not to stay signed in.
14. Encrypt devices with built-in tools such as BitLocker or FileVault, and require screen locks.
15. Authenticate your email domain with SPF, DKIM and DMARC so attackers can't easily spoof you.
16. Restrict file sharing defaults so new documents are private until shared.
17. Back up critical data using the 3-2-1 rule, with at least one copy offline or immutable.
18. Train staff to spot phishing and payment-change scams, and give them a simple way to report.

Detect: notice when something is wrong

19. Turn on alerts for suspicious sign-ins, new admin accounts, mail forwarding rules and large file downloads in Microsoft 365 or Google Workspace.
20. Review login activity monthly for admin accounts.
21. Monitor your public footprint: website uptime, unexpected changes and your domain's DMARC reports.

Respond: act fast when it happens

22. Write a one-page incident plan: who to call, how to isolate a device, who contacts the bank, lawyer and insurer.
23. Keep an offline contact list for your bank's fraud team, IT support, legal counsel and cyber insurer.

Recover: get back to normal

24. Test restores quarterly from backup to a clean device or account.
25. Hold a short review after any incident to fix the root cause and update this checklist.

Priority order if you're starting from zero

Controls by business type

From experience. When we moved a Malaysian clinic from paper records to a digital queue and EMR, the security questions were the same basic ones every small business faces: who can log in to what, how shared passwords are retired, and how data comes back if a device fails. Answer those well and you have covered most of this checklist.

The 30-minute quarterly security review

A checklist only works if someone revisits it. Put a recurring 30-minute meeting on the calendar and walk through these questions:

1. People: Who joined, left or changed roles? Are their accounts, password manager access and shared files updated?
2. Admins: Who holds admin rights in email, banking, the domain registrar, hosting and your store or CRM? Is every admin still necessary?
3. MFA coverage: Does any account still rely on a password alone? Are admins on phishing-resistant methods?
4. Updates: Are any devices, plugins or apps out of date or no longer supported by the vendor?
5. Backups: When was the last successful restore test, and did it include a full system or just one file?
6. Alerts: Did anything unusual show up in sign-in logs or DMARC reports? Was it explained?
7. Plan: Are the phone numbers in your incident plan still correct?

Record the answers in a simple shared document. The record itself becomes useful evidence for customers, insurers and auditors who ask how you manage security.

Free resources worth bookmarking

Cyber insurance: a note before you buy

Cyber insurance can help pay for forensics, legal advice, notification and business interruption after an incident. Expect an application to ask how you handle controls such as MFA and backups, so the work in this checklist also prepares you to answer accurately. Read exclusions carefully, especially for social engineering and funds transfer fraud, and confirm whether you must use the insurer's incident response firm.

Common mistakes to avoid

• Sharing one login among staff, which destroys accountability and makes offboarding impossible
• SMS-only MFA on admin accounts when stronger options are available
• Backups that sync deletions, so ransomware or an accident wipes the "backup" too
• No offboarding process, leaving former staff or contractors with access
• Ignoring the domain registrar, which controls your email and website

Next steps

• Turn on MFA for your email and banking today, then work through the six-week plan.
• Set up a team password manager using our guide to 2FA and password managers for teams.
• Lock down your core platform with how to secure Google Workspace and Microsoft 365.
• Build a backup you can trust with the 3-2-1 backup strategy, and keep what to do after a data breach bookmarked.
• If you want an experienced technical leader to own security alongside product and infrastructure, see our fractional CTO service.

Sources

• FBI IC3, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• NIST SP 1300, CSF 2.0 Small Business Quick-Start Guide: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf
• NIST SP 800-63B-4, Authenticators (password verifiers): https://pages.nist.gov/800-63-4/sp800-63b/authenticators/
• CISA, Require Strong Passwords: https://www.cisa.gov/secure-our-world/require-strong-passwords
• Microsoft, Security defaults in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
• Google Workspace, Security checklist for small businesses: https://knowledge.workspace.google.com/admin/security/security-checklist-for-small-businesses-1-100-users

Keep reading