A Practical Cyber Security Checklist for Small Business

Security advice often stays vague. This does not. Here are twenty concrete steps, grouped so you can work through them a section at a time. You will not need to do all twenty at once — but each one you tick off makes your business a harder target.

Passwords and accounts

• Use a password manager so every login is unique and strong.
• Turn on two-factor authentication for email, banking, and hosting.
• Never share logins between staff — give everyone their own.
• Remove accounts for people who have left, the day they leave.
• Give each person access only to what their role needs.

Updates and devices

• Apply software and operating-system updates promptly.
• Keep WordPress core, plugins, and themes current.
• Run anti-malware on every computer and keep it updated.
• Lock or log out of devices when they are unattended.
• Encrypt laptops so a lost device is not a lost database.

Backups and recovery

• Back up automatically — do not rely on remembering.
• Store backups off-site, not just on the same machine.
• Test a restore at least once so you know it works.
• Keep enough history to roll back past a problem you missed.

Email and people

• Treat urgent, unexpected emails with suspicion.
• Check the real sender address before acting on a request.
• Confirm any change of payment details by phone, never by email reply.
• Give staff a couple of plain rules — awareness beats software here.

Your network and website

• Change default passwords on routers and connected devices, and keep a separate guest Wi-Fi.
• Make sure your website uses HTTPS and its SSL certificate never lapses.

Where to start

If twenty feels like a lot, start with the five in the first section — passwords and accounts are where most breaches begin, and they cost nothing but a little setup. Work down from there as you have time.

The honest truth about small-business security is that it is not about one clever tool; it is about doing ordinary things consistently. If keeping on top of a list like this is not realistic alongside running your business, that is exactly what managed IT and security services are for — we make it our job so it does not have to be yours.