The Small Business IT Security Checklist

Use Multi-Factor Authentication

Passwords alone are no longer enough. Multi-factor authentication, often called MFA, adds another step when someone signs into an account. Employees may need to approve a notification on their phone, enter a temporary code, or use another verification method.

MFA should be enabled anywhere it is available, especially for email, Microsoft 365, Google Workspace, financial systems, and administrator accounts.

Keep Computers and Software Updated

Software updates often fix security vulnerabilities in addition to adding features. Computers, servers, applications, browsers, firewalls, and other devices should be regularly updated.

Updates should not depend entirely on employees remembering to install them.

Protect Every Computer

Business computers should have modern endpoint security installed and actively monitored. This helps detect malicious software and suspicious activity that traditional antivirus products may miss.

Back Up Important Data

Backups are an important part of both cybersecurity and disaster recovery. A reliable backup system should run automatically, be monitored, and include a way to recover data if files are deleted, encrypted, corrupted, or lost.

Secure Email Accounts

Email continues to be one of the most common ways attackers target businesses. Employees should know how to recognize:

• Fake login pages
• Unexpected password reset messages
• Suspicious attachments
• Fake invoices
• Requests to change banking information

Strong email filtering and MFA provide additional protection.

Limit Administrator Access

Employees should only have access to the systems and information they actually need. Administrator accounts should be limited and protected carefully.

When an employee leaves the company, their access should be removed promptly.

Know What Technology You Have

It is difficult to protect equipment you do not know exists. Businesses should maintain an inventory of computers, servers, network equipment, cloud services, and important software.

Have a Plan for Security Incidents

Every business should have at least a basic plan for what to do if something goes wrong. Employees should know who to contact if they:

• Click a suspicious link
• Lose a laptop
• Suspect an account has been compromised
• Receive a ransomware message
• Notice unusual activity

Quick action can make a significant difference.