If you run a small business with 2-50 employees, cybersecurity can feel overwhelming. You don't have a dedicated IT team, let alone a security department. The good news: most attacks exploit the same basic vulnerabilities, and fixing them doesn't require a tech degree.
This checklist covers 25 essential security measures, organized by priority. Start with the critical items today — they're free and take minutes to implement. Use the linked password-manager rollout guide, email-security guide, and ransomware guide when you need a deeper implementation plan.
Start with the security fundamentals
Use this checklist to put the highest-impact protections in place before you consider adding another security product.
Start today’s actions →Critical — Do These Today
These are the most exploited vulnerabilities. Every small business should have these in place immediately.
1. Enable Multi-Factor Authentication (MFA) on All Accounts
MFA can substantially reduce the risk of automated account takeover, but it is not a complete guarantee. Enable it on email, banking, cloud services, and any tool that stores customer data. Use an authenticator app (Google Authenticator, Microsoft Authenticator) rather than SMS when possible.
2. Set Up a Business Password Manager
Stop sharing passwords via email or Slack. A business password manager lets your team securely share credentials without exposing them. NordLayer includes a password manager with its business plan, or Bitwarden offers a standalone option starting at $3/user/month.
3. Enable Automatic Software Updates
Outdated software is the #1 entry point for ransomware. Enable auto-updates on Windows, macOS, browsers, and all business applications. This single step closes the most common attack vector.
4. Set Up Automated Backups
Back up all business data daily to a separate location (cloud or offline). Test your backups monthly — a backup you can't restore is worthless. Choose a backup service that supports version history, offline or immutable copies, and documented restore testing.
5. Secure Your Email
Email is a common route for phishing and account-takeover attempts. Enable SPF, DKIM, and DMARC records for your domain (your email provider can help). Train staff to recognize phishing — suspicious links, unexpected attachments, and urgent requests for credentials or payments.
High Priority — Do This Week
These measures significantly reduce your attack surface and protect against more sophisticated threats.
6. Install Endpoint Protection on All Devices
Every computer and phone that accesses business data needs endpoint protection. A provider may offer centralized device management; verify current coverage and recovery features in the vendor documentation.
7. Set Up a Business VPN
Any employee working remotely or using public WiFi needs a VPN. NordLayer Business provides unlimited VPN access for your team, included in their $29/month plan. This encrypts all internet traffic and protects sensitive data.
8. Create an Access Control Policy
Not every employee needs access to everything. Use the principle of least privilege: give people access only to the systems they need for their job. Review access when roles change or someone leaves.
9. Secure Your WiFi Network
Change the default router password. Use WPA3 encryption (or WPA2 at minimum). Create a separate guest network for visitors. Hide your network name (SSID) if possible.
10. Establish a Bring Your Own Device (BYOD) Policy
If employees use personal devices for work, require: device encryption, screen lock, up-to-date OS, and the ability to remotely wipe the device if lost or stolen.
11. Set Up Email Filtering
Use your email provider’s documented filtering, SPF, DKIM, and DMARC controls to reduce spam, phishing, and spoofing. Add a dedicated gateway only when your risk, volume, or compliance requirements justify the extra complexity.
12. Create an Incident Response Plan
Write down what to do if you're attacked. Include: who to contact, how to isolate infected systems, how to restore from backups, and how to notify affected customers. A 1-page plan is better than no plan.
Important — Do This Month
These build long-term security maturity and protect against advanced threats.
13. Conduct Security Awareness Training
Train all employees on: recognizing phishing emails, safe browsing habits, password hygiene, and reporting suspicious activity. Repeat quarterly. Free resources are available from CISA (cisa.gov).
14. Implement a Firewall
Ensure your network has a properly configured firewall. Most business routers include one, but verify it's enabled and updated. For businesses handling sensitive data, consider a next-generation firewall (NGFW).
15. Encrypt Sensitive Data
Encrypt customer data, financial records, and employee information both in transit and at rest. Full-disk encryption (BitLocker for Windows, FileVault for Mac) should be enabled on all devices.
16. Set Up Activity Logging
Enable logging on critical systems so you can detect and investigate suspicious activity. At minimum, log: login attempts, file access, and administrative changes.
17. Create an Offboarding Checklist
When an employee leaves, immediately: disable their accounts, recover company devices, revoke access to all systems, and change any shared passwords.
18. Review Third-Party Vendor Access
Audit which vendors have access to your systems and data. Remove access from vendors you no longer use. Ensure vendors follow security best practices.
19. Register for Alerts
Sign up for CISA alerts (cisa.gov/news-events/cybersecurity-advisories) to stay informed about new threats targeting small businesses.
Ongoing — Maintain Quarterly
Security isn't a one-time project. These tasks should be repeated every quarter.
20. Run Vulnerability Scans
Use a documented vulnerability-scanning tool and verify its coverage before relying on it. Fix critical findings within 48 hours.
21. Test Your Backups
Actually restore from your backups quarterly. Verify the data is complete and usable. A backup that hasn't been tested is a gamble.
22. Update Your Incident Response Plan
Review and update your plan as your business changes. Test it with a tabletop exercise — walk through a hypothetical attack scenario with your team.
23. Review User Access
Quarterly, review who has access to what. Remove unnecessary permissions. Ensure former employees have no remaining access.
24. Check for Data Leaks
Search for your business email addresses on breach databases (haveibeenpwned.com). If credentials have been leaked, force a password reset immediately.
25. Review and Update This Checklist
Threats evolve. Revisit this checklist every quarter and add new items as your business grows and the threat landscape changes.
Quick-Start: Your First 48 Hours
If this feels overwhelming, focus on just these five actions in your first two days:
- Enable MFA on every business account (email, banking, cloud)
- Set up a password manager and stop sharing passwords via email
- Enable automatic updates on all devices
- Set up automated daily backups
- Send a team email about phishing awareness
How We Review Products
Small Business Security Guide is fully independent. We use structured editorial comparison based on documented vendor information and independently published sources. We record the review focus and last-reviewed date, and readers should verify current features and pricing with the provider. We may earn a commission if you sign up through our links, but commercial partnerships never influence our editorial scoring.
Use documented tools to cover the essentials
A provider may address some of these areas depending on current documented features. Check current provider pricing and terms before purchase.
Return to today’s priorities →