The small business security checklist
Practical security for a small business or startup without a dedicated security person. Work through it in order: the few steps that stop most real-world attacks come first.
In short. A small business security checklist is a prioritised set of steps that protect a company without a dedicated security team. Each item below is tagged Required, Recommended, or Optional, and follows the CISA Cyber Essentials, NIST Cybersecurity Framework, and CIS Controls (IG1) baselines.
Lock down accounts and access
Most breaches start with one stolen or reused login. Fix this first.
A password alone is not enough. Require a second factor (an app code or a hardware key) on email, your admin consoles, banking, and every account that matters. Phishing-resistant keys are best for the accounts that would hurt most if lost.
No shared accounts and no passwords in a spreadsheet. A password manager lets each person keep long, unique passwords without remembering them, and lets you revoke access cleanly when someone leaves.
Keep a simple offboarding checklist: disable their accounts, rotate any shared secrets they knew, and reclaim their devices the same day. Dormant accounts are a favourite way back in.
Do day-to-day work in a normal account and use a separate admin login only when you need it. Give each person the least access their job requires, and review who has admin every few months.
Secure your email
Email is the number-one way small businesses get attacked, through phishing and invoice fraud.
These three DNS records let the world verify that mail claiming to be from you really is. Without them, anyone can send convincing email as your company. Once SPF and DKIM pass, set DMARC to at least quarantine.
Business email compromise, where an attacker poses as a supplier or your boss and asks to change payment details, is the costliest scam for small businesses. Confirm every such request by phone or in person, never by replying to the email.
Teach people the common signs (urgency, a lookalike sender, a link that does not match) and make it normal to pause and check. A short quarterly refresher beats a one-time lecture.
Google Workspace and Microsoft 365 both ship stronger anti-phishing and attachment scanning that is off or low by default. Turn it up.
Protect your devices
Encryption (FileVault on Mac, BitLocker on Windows) means a lost or stolen device is not a data breach. Automatic updates close the holes attackers rely on. Both are free and built in.
A short auto-lock and a real passcode stop the casual theft that leads to account takeover. Enforce it on phones too, since they hold your email and your login codes.
Keep a reputable antivirus or endpoint tool on. Once you have more than a handful of laptops, a light device-management tool lets you enforce these settings and wipe a lost device remotely.
A short list of who has what makes offboarding, updates, and loss reporting far easier. A spreadsheet is fine to start.
Look after your data and backups
Follow 3-2-1: three copies, on two kinds of media, one off-site. Encrypt them, and actually try restoring once, because a backup you have never tested is a guess. Good backups are your main defence against ransomware.
API keys, passwords, and access tokens pasted into a shared doc or a chat channel leak constantly. Store them in your password manager or a secrets manager, and rotate any that have been passed around.
Make a short map of where customer data, financials, and credentials sit. You cannot protect what you have not located, and most oversharing comes from files nobody realised were exposed.
Default document sharing to named people rather than public links for anything sensitive. Review broad shares periodically and turn off link sharing that is no longer needed.
Secure your SaaS and vendors
A forgotten tool with a weak login is often the way in. Enforce multi-factor on every service that holds your data or connects to the ones that do.
Every ‘sign in with Google’ and connected app has standing access to your data. Audit these grants, revoke anything unused, and be careful which apps you approve.
Before you route customer data through a tool, read how they secure it, whether they hold a SOC 2 or ISO 27001, and what happens to your data if you leave.
Knowing your stack makes offboarding, incident response, and renewals easier, and surfaces the shadow tools nobody signed off on.
Harden your network and website
Use WPA2 or WPA3 with a strong password, and put guests and untrusted devices on their own network so they cannot reach your computers and shared drives.
Serve everything over HTTPS, and keep your website, CMS, and its plugins up to date. An out-of-date plugin is one of the most common ways a small company’s site gets defaced or used to attack visitors.
Routers, cameras, printers, and network drives often ship with a known default login. Change them, or they become an easy foothold.
A DNS filter is a cheap way to stop staff reaching malware and phishing domains, with nothing to install on each device.
People and process
People will click the wrong link. What decides the outcome is whether they tell you in the first five minutes or hide it for a week. Reward reporting, and put these basics in front of every new hire on day one.
A short, plain-language policy (passwords, MFA, devices, data handling, who to contact) beats a fifty-page document nobody reads. Make it part of onboarding and easy to locate.
Write a short incident plan: who is in charge, how you contain an account or device, who tells customers, and the numbers for your bank, your insurer, and outside help. Inventing this mid-incident is how a small problem becomes a public one.
As you hold more customer data, cyber insurance and a clear grasp of your breach-notification obligations become worth the time. Read the policy conditions, since many require the controls above.
Frequently asked questions
What is a small business security checklist?
A short, prioritised list of the security steps a small business or startup should take, especially when there is no dedicated IT or security person. It covers accounts and access, email, devices, data and backups, your SaaS and vendors, your network and website, and the people and process around them.
What are the most important security steps for a small business?
Turn on multi-factor authentication everywhere (starting with email and admin accounts), give everyone their own login with a password manager, keep devices encrypted and updated, back up your data and test a restore, and remove access the moment someone leaves. Those five cover the majority of real-world attacks.
Do hackers really target small businesses?
Yes. Most attacks are automated and opportunistic rather than hand-picked, so a small business with weak MFA or an unpatched website is an easy target. Small companies are also attacked as a way into their larger customers and partners.
How much does small business security cost?
Most of this checklist is free or built in: MFA, encryption, updates, and backups cost time rather than money. The paid items (a password manager, endpoint protection, DNS filtering) are inexpensive per user. A penetration test is the main investment, and it is worth it once you hold sensitive customer data or a customer requires one.
When does a small business need a penetration test?
When you build the product customers trust with their data, before a launch or a security audit, or when a customer or regulator asks for evidence. A checklist confirms what you configured; a penetration test proves what an attacker could actually reach.
Where SecureLayer7 fits
Most of this list is work you can do yourself. Where an outside perspective helps most is proving what an attacker could actually reach, before someone else does.
A checklist tells you what you set up. A penetration test shows what an attacker could really do, from the outside in, so you fix what matters before someone finds it for you.
CREST-accredited and CERT-In empanelled testers who publish their own CVEs test your application, network, and cloud, and hand you a report your customers and auditors take seriously, with a re-test to confirm the fixes.
BugDazz maps your external footprint and keeps testing it as you add tools, people, and features, so new exposure shows up as a finding, not an incident.
Sources