Small Business Cybersecurity Checklist

• Turn on multi-factor authentication (MFA) for email, Microsoft 365, remote access, banking and every other service that offers it. See our multi-factor authentication guide.
• Use a business password manager, so every account has its own strong password.
• Give administrator rights only to the people who need them, and use separate accounts for admin work.
• Remove access promptly when employees leave. See our onboarding and offboarding checklist.

• Protect every computer and server with endpoint protection that someone monitors.
• Install security updates for Windows, macOS, applications and browsers on a schedule.
• Encrypt laptops and require a screen lock on computers and phones.
• Keep a list of company devices, and replace those that no longer receive security updates.

• Filter incoming email for phishing, malware and spoofed senders.
• Publish SPF, DKIM and DMARC records for your domain.
• Confirm any request to change payment details or send money by calling a known phone number.
• Make it easy for employees to report a suspicious email, and thank them when they do.

• Use a business firewall that is kept up to date and monitored.
• Keep guest Wi-Fi separate from the network your business computers use.
• Change default passwords on routers, firewalls, cameras and other devices.
• Require MFA for remote access to the office network. See network security services.

• Back up servers, key applications and Microsoft 365 email and files.
• Keep at least one backup copy separate from your main network, so ransomware cannot reach it.
• Test restores on a schedule, not only when something goes wrong.
• Know where sensitive data is kept, and limit who can see and share it.

• Give employees short, regular security awareness training.
• Write down what to do and who to call if you suspect an attack.
• Review which vendors and outside providers have access to your systems.
• Review your cyber insurance requirements before each renewal.

If you can only do three things this month, turn on multi-factor authentication everywhere, make sure backups run and can be restored, and confirm that every computer has endpoint protection and current security updates.

Then work through email security, network settings, training and a written response plan. Many of these steps are part of managed IT services, so they are done and checked every month rather than once.

Endpoint protection, security patching and 24/7 monitoring are included on every managed workstation and server. Our cybersecurity services add multi-factor authentication, conditional access, identity protection and Microsoft 365 security, and backup and disaster recovery covers backups and tested recovery.

TechStarters is a SOC 2 Type II audited managed service provider supporting businesses nationwide, with offices in New Jersey, Pennsylvania, Delaware and New York. Every engagement starts with a free IT assessment.