Small businesses are not too small to be targeted. Attackers often prefer them because defenses are lighter. The good news is that a handful of basic measures prevent a large share of common incidents. This checklist is ordered by impact for teams without a dedicated IT department. It is general guidance, not a substitute for professional security assessment; for guidance from public agencies, consult the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission's small-business resources.
1. Accounts: passwords and multi-factor authentication
Use a password manager
People reuse passwords because humans cannot memorize dozens of unique ones. A reputable password manager generates and stores a unique password for each account, so a breach at one service does not unlock others. Choose a manager that supports team sharing if multiple people need access to the same accounts, rather than sharing passwords by email or chat.
Turn on multi-factor authentication (MFA)
MFA requires a second proof of identity, such as a code from an authenticator app or a hardware security key, in addition to the password. Prioritize these accounts first:
- Email accounts (they control password resets for everything else)
- Cloud storage and document tools
- Banking and payroll
- Domain registrar and website hosting
- Social media and advertising accounts
Authenticator apps and security keys are generally stronger than text-message codes, though any MFA is better than none.
Use individual accounts
Shared logins make it impossible to know who did what and difficult to revoke access when someone leaves. Give each person their own account, even if it costs a little more.
2. Devices and software
- Keep systems updated. Turn on automatic updates for operating systems, browsers, and apps. Many attacks exploit known flaws that updates already fix.
- Lock screens automatically after a few minutes of inactivity.
- Encrypt laptops and phones. Modern operating systems include built-in disk encryption; confirm it is turned on so a lost device does not mean exposed data.
- Use reputable security software where appropriate for your devices.
- Keep an inventory of company devices and who has them.
- Separate work and personal use where practical, and set a clear policy for personal devices that access work data.
3. Email and web habits
Most breaches begin with a person being tricked. Train everyone to pause before clicking links, opening unexpected attachments, or acting on urgent payment requests. See Recognizing Phishing Emails for specific signals. Establish a rule that any change to payment details requires verification through a second channel, such as calling a known number.
4. Data: access and backups
- Limit access to what each person needs (see File Permissions Explained).
- Back up important data in a way that cannot be changed by the same account an attacker might compromise (see Backups for Small Businesses).
- Know what sensitive data you hold: customer information, employee records, payment details. Keep only what you need.
5. Network basics
- Change default administrator passwords on routers and other equipment.
- Use WPA2 or WPA3 security on office Wi-Fi, and keep a separate guest network.
- Be careful with public Wi-Fi; prefer a trusted connection or a reputable VPN when handling sensitive information away from the office.
6. People: onboarding and offboarding
Onboarding
Give new staff a short security briefing on day one: how to use the password manager, how to report suspicious messages, and where policies live.
Offboarding
When someone leaves, act the same day:
- Disable or remove their accounts and access to shared files.
- Transfer ownership of documents they own (before deleting the account, if your tools require it).
- Collect devices and securely wipe them.
- Change shared credentials they knew, such as Wi-Fi and any shared account passwords.
- Review which third-party services were tied to their email address.
7. Have an incident plan
You will respond better to an incident if you decided in advance what to do. Write a one-page plan covering who to call first, how to isolate affected devices (disconnect from the network), how to preserve evidence, whom to notify (customers, insurers, law enforcement), and which legal obligations may apply. Data breach notification rules differ by state; consult a qualified attorney for your situation.
The checklist
| Priority | Action | Done? |
|---|---|---|
| High | MFA on email, banking, cloud storage, domain registrar | ☐ |
| High | Password manager adopted by everyone | ☐ |
| High | Automatic updates enabled everywhere | ☐ |
| High | Backups configured and restore tested | ☐ |
| Medium | Individual accounts, no shared logins | ☐ |
| Medium | Disk encryption on laptops and phones | ☐ |
| Medium | Offboarding checklist in place | ☐ |
| Medium | Phishing awareness briefing for all staff | ☐ |
| Ongoing | Quarterly access review | ☐ |
Advantages and limitations
Advantages
- Addresses the most common causes of small-business incidents.
- Mostly inexpensive and low-technical.
- Builds a security-conscious culture.
Limitations
- Does not guarantee safety against determined or sophisticated attackers.
- Regulated industries have additional legal requirements.
- Needs regular review as tools and threats change.
Conclusion
Security improves most through consistent basics: unique passwords with MFA, updates, limited access, tested backups, and informed staff. Start with the high-priority items this week. Then read Recognizing Phishing Emails to strengthen the human side.
Independent and educational. This article is general information, not professional, legal, or technical-support advice. Workplace Productivity Hub is not affiliated with any software vendor. Features, menu names, and limits vary by product and plan and change over time, so confirm details in your own tools' official documentation. See our editorial standards and corrections policy.