Do these seven things first: require multifactor authentication on admin and remote accounts, turn on automated backups and test the restores, patch by exposure and risk, inventory every device and account you own, write a one-page incident response plan, train employees to spot phishing, and cut vendor access down to what each vendor actually needs. Every one of these maps to the NIST Cybersecurity Framework 2.0 and CIS Controls IG1. None require a big budget or a big team. They just require doing them in order.
TL;DR:
- Small businesses should prioritize enabling multifactor authentication on admin, remote, and email accounts within the first 30 days to reduce the most common attack vectors.
- Building a comprehensive asset inventory early on helps identify unrecognized devices, accounts, and sensitive data, which are often overlooked but critical for effective protection.
- Regular patching of exposed internet-facing systems and changing default passwords on devices are essential for closing known entry points that attackers frequently exploit.
- Implementing tested backups with offline or encrypted storage ensures recovery capability and turns a ransomware attack into a manageable incident rather than a disaster.
- Ongoing employee training on phishing recognition and managing vendor access minimizes human error and third-party risks, strengthening the overall security posture.
Table of Contents
- Why Small Businesses Need a Cybersecurity Checklist
- The Threats This Checklist Is Built to Stop
- How to Use This Checklist: 30, 90, and 180 Days
- Build an Asset Inventory Before You Do Anything Else
- Lock Down Access: MFA, Passwords, and Least Privilege
- Patch Systems and Fix Default Settings
- Backups: The Difference Between an Incident and a Disaster
- Write and Practice an Incident Response Plan
- Train Employees to Spot and Report Phishing
- Manage Vendor and Supply-Chain Risk
- Monitor Your Network and Protect Every Endpoint
- Keep Governance Simple but Consistent
- Your Next Steps and When to Call for Help
- How Total Cyber Approaches Small-Business Security
- Get Help Implementing This Checklist
- Authoritative Resources and Templates
- Sources
- FAQ
Why Small Businesses Need a Cybersecurity Checklist
You don’t have unlimited hours or an unlimited budget, and attackers know that. That’s exactly why a prioritized checklist beats a scattershot approach: it puts your limited time against the controls that block the most attacks, not the ones that feel most urgent on a Tuesday.
The FBI’s Internet Crime Complaint Center logged roughly 3,000 complaints a day in 2025, with losses running into the billions. Small businesses are a favorite target precisely because they often skip the basics.
A checklist built around a real framework gives you a way to measure progress instead of guessing:
- It tells you what to fix first when you can’t fix everything at once.
- It gives you a common language with your IT provider, insurer, or auditor.
- It turns “we should be more secure” into specific, checkable tasks.
The Threats This Checklist Is Built to Stop
Every item on this list exists because of a specific attack pattern, not a hypothetical one. Understanding the threat makes the fix feel less like busywork.
- Phishing and business email compromise trick employees into wiring money or handing over credentials, often through a convincing message that looks like it’s from a vendor or the boss.
- Ransomware locks up files and demands payment, and it hits harder when backups either don’t exist or were never tested.
- Credential theft and account takeover happen when passwords are reused across sites or accounts have no second layer of verification.
- Unpatched, internet-facing systems get scanned constantly by automated tools looking for a known, unfixed hole.
- Vendor and supply-chain compromises let attackers walk in through a trusted third party instead of knocking on your front door directly.
Cyber threats keep evolving, but the entry points stay remarkably consistent year over year.
How to Use This Checklist: 30, 90, and 180 Days
Don’t try to do everything this week. Sequence it.
- Days 1 to 30: Enable MFA on admin, remote-access, and email accounts. Confirm backups are running and test one restore.
- Days 31 to 90: Build your asset inventory, tighten patching, and draft your incident response plan.
- Day 180 and beyond: Formalize vendor reviews, run a tabletop exercise, and revisit everything quarterly.
Assign one owner per task. A simple metric, like the percentage of admin accounts with MFA enabled or the date of your last successful restore, tells you if you’re actually making progress.
Build an Asset Inventory Before You Do Anything Else
You can’t protect what you don’t know you have. Start by listing every laptop, server, phone, and SaaS account tied to your business, along with who owns it and what data touches it.
- List endpoints, servers, and network devices, including anything employees use remotely.
- Catalog cloud and SaaS accounts, especially ones set up by individual employees without IT’s knowledge.
- Map where sensitive data lives, whether that’s customer records, payment details, or employee files.
- Note which accounts have admin rights and whether that access is still needed.
Vulnerability scanning tools or a managed vulnerability analysis service can surface devices and accounts you forgot existed, which happens more often than most owners expect.
Pro Tip: Run your first inventory pass with a spreadsheet, not software. You’ll spend less time fighting a tool and more time actually finding the shadow SaaS subscription your marketing team signed up for last spring.
Lock Down Access: MFA, Passwords, and Least Privilege
If you do only one thing from this entire checklist, make it this. CISA recommends requiring MFA across email, file storage, remote access, and privileged accounts, starting with the accounts that would cause the most damage if compromised.
- Turn on MFA for admin, remote-access, and email accounts first. These are the accounts attackers target hardest.
- Choose phishing-resistant methods like security keys or number-matching authenticators over basic SMS codes where you can.
- Eliminate shared logins. Every person gets their own account, tied to their own name.
- Enforce least privilege: employees get access to what their job requires, nothing more.
Sequencing MFA by account risk, privileged and remote access first, gets you the fastest risk reduction when time and staff are both limited.
Pro Tip: A password manager for your team costs less per month than a single coffee run and eliminates the sticky note under the keyboard. Combine it with remote work security practices if any part of your team works outside the office.
Patch Systems and Fix Default Settings
Unpatched software is still one of the easiest ways in, mostly because patching feels boring until it isn’t.
- Turn on automatic updates wherever it’s safe to do so, and keep a simple log for systems that need manual testing first.
- Identify anything exposed to the internet (a website, a remote desktop portal, a VPN gateway) and patch those first, since they’re the ones attackers scan for constantly.
- Change every default password on routers, cameras, and other devices the moment they’re installed.
- Remove services and software you’re not actually using; every unused login is one more door left unlocked.
Backups: The Difference Between an Incident and a Disaster
A ransomware attack without backups is a business-ending event. With tested backups, it’s a bad week. CISA’s guidance on backing up business data lays out the core requirements clearly.
- Identify your genuinely critical data and back it up automatically, on a schedule you don’t have to remember to trigger.
- Keep backup copies physically or logically separate from your main systems, so a single breach can’t take both out.
- Encrypt backups and consider immutable storage, which resists ransomware that tries to delete or overwrite recovery copies.
- Set realistic recovery time and recovery point objectives, then document the actual steps needed to restore under pressure.
Backups that have never been tested are a hope, not a plan. CISA notes that scheduled backups alone don’t prove anything; only a real restore test reveals whether a backup is usable or was silently corrupting for months. Also confirm you can reach your backups even if your main identity or network system is down, since that’s often exactly when you’ll need to.
Working out your actual RTO and RPO targets instead of guessing at them saves painful surprises during a real outage.
Write and Practice an Incident Response Plan
A plan that exists only in someone’s head disappears the moment that person is unreachable. CISA recommends a written incident response plan, approved by leadership, kept offline, and reviewed quarterly.
- Assign clear roles: an incident manager, a technical lead, someone handling communications, and legal counsel if you have access to one.
- Print your plan and keep an offline contact list; your email and file systems may be exactly what’s unavailable during an attack.
- Run a tabletop exercise at least once, walking through a realistic scenario as a team.
- Update the plan and your communication templates after every exercise or real incident, so lessons don’t evaporate.
Pro Tip: Keep the plan to two pages. A ten-page policy document nobody can find fast during a crisis is worse than a sticky note taped inside a locked drawer with the right phone numbers on it. Our Virginia breach response planning steps walk through a workable structure if you’re starting from scratch.
Train Employees to Spot and Report Phishing
Your firewall can’t stop an employee from clicking a convincing link. Ongoing training can shift that.
- Run security awareness training on a recurring schedule, not as a one-time onboarding checkbox.
- Send simulated phishing emails periodically and track who clicks, then coach rather than punish.
- Build a no-blame reporting culture with a dedicated inbox or a one-click “report this” button, so people flag suspicious messages fast instead of hiding a mistake.
- Cover remote-work habits and personal device use in every training refresh, since home and mobile setups often get skipped.
Reviewing real phishing examples employees actually receive tends to land better than generic warnings about “suspicious emails.”
Manage Vendor and Supply-Chain Risk
Your security is only as strong as the weakest vendor with access to your systems. NIST’s vendor due diligence guidance recommends scaling how deep you dig based on how critical each vendor actually is.
- Rank vendors by criticality and require baseline security controls plus incident notification terms in contracts for the important ones.
- Ask for evidence, not just a questionnaire response; independent audits or certifications carry more weight than a vendor’s self-assessment.
- Watch for foreign ownership or opaque supply-chain tiers on vendors handling sensitive systems or data.
- Limit vendor access to exactly what they need, using separate accounts you can log and revoke on your own schedule.
Monitor Your Network and Protect Every Endpoint
You can’t respond to what you can’t see. Basic monitoring and endpoint protection close that gap without requiring a full security team.
- Deploy endpoint detection and response (EDR) or modern antivirus software sized to your business, with automatic signature and behavior updates.
- Centralize logs from authentication systems, firewalls, and VPNs, and set alert thresholds for activity that looks off.
- If you don’t have internal capacity to watch logs around the clock, a managed detection and response service fills that gap without requiring a full-time hire.
Keep Governance Simple but Consistent
None of this sticks without someone owning it and revisiting it on a schedule.
- Write down simple, plain-language policies for access, backups, incident response, and vendor security.
- Assign an owner for each policy area and set a quarterly review date on the calendar, not just “when we get to it.”
- Map your progress against NIST CSF 2.0 or CIS IG1 periodically to see where your maturity actually stands and what’s next.
Cybersecurity risk scoring can help turn “we should improve” into a number you can track quarter over quarter.
Your Next Steps and When to Call for Help
Start with the 30/90/180 sequence above and revisit it every quarter. Templates for incident response plans and backup policies are listed in the sources section below.
- If your team lacks the bandwidth to own this list, or a restore test just failed, that’s the signal to bring in outside help.
- Active compromise is never a do-it-yourself moment. Call a provider immediately.
How Total Cyber Approaches Small-Business Security
Most of the SMBs we talk to don’t fail because they don’t care about security. They fail because nobody owns it full time, and the list above competes with payroll, sales, and everything else on a Tuesday.
Security can be built into managed IT delivery rather than sold as a separate add-on, with leadership and incident response support included. We help map clients to NIST and CIS priorities, then track real outcomes: MFA coverage across admin accounts, restore tests that actually complete, vendor access trimmed to what’s necessary. If you want a second set of eyes on where your business stands, request a discovery call.
— Alden
Get Help Implementing This Checklist
Reading a checklist is easy. Enforcing MFA across forty employee accounts while running your actual business is harder, and that gap is where most of these good intentions quietly die.
Total Cyber’s managed cybersecurity services build MFA enforcement, tested backups, patch management, and incident response into one ongoing engagement instead of a dozen separate tools you have to babysit. Our managed IT services cover the patching and monitoring side so your internal team isn’t stretched across security and everything else at once. A discovery call can start with a look at where you stand against NIST and CIS priorities, then a straightforward plan for closing the gaps that matter most first. If a breach response plan or communications playbook is part of what you need next, our partner resource on managing online reputation during a crisis is worth a look too. Ready to see where your business actually stands? Request your discovery call and get a straight answer instead of a sales pitch.
Authoritative Resources and Templates
- CISA — Cyber Guidance for Small Businesses: core checklist covering MFA, backups, and incident response basics.
- CISA — Incident Response Plan Basics: a practical template for building your written IR plan.
- NIST SP 1300 — Small Business Quick-Start Guide: maps checklist actions to the full CSF 2.0 framework.
- CIS Controls IG1: the essential safeguard list for organizations with limited resources.
Sources
- CISA — Cyber Guidance for Small Businesses
- NIST SP 1300 — NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
- CIS Controls — Implementation Groups IG1
- FBI IC3 Annual Report 2025
FAQ
What Are the 5 C’s of Cybersecurity?
Definitions vary by source, but a common version covers change, compliance, cost, continuity, and coverage, referring to how businesses manage evolving threats, regulatory requirements, budget, operational resilience, and protection scope. It’s a useful mental model but not a substitute for a specific framework like NIST CSF 2.0 or CIS IG1 when building an actual checklist.
What Are the 5 D’s of Cybersecurity?
The so-called layered defense concepts commonly described as deter, detect, defend, delay, and deny represent broad security principles rather than a strict checklist. In practice, small businesses cover these ideas through the same core controls: MFA, monitoring, endpoint protection, and tested backups.
What’s the Fastest Way to Improve Small Business Security Measures This Month?
Enable multifactor authentication on admin, remote-access, and email accounts first, since CISA identifies these as the highest-value targets. Pair that with one confirmed backup restore test; those two moves alone close the gaps attackers exploit most often.
Do I Need a Full Risk Assessment Before Starting a Cybersecurity Checklist?
No. Start executing the highest-impact items, MFA, backups, and patching, while you build your asset inventory in parallel. A formal cyber risk assessment guide or a vulnerability scanning engagement helps refine priorities later, but it shouldn’t delay the basics.
How Often Should a Small Business Update Its Cybersecurity Checklist?
Review your checklist and incident response plan quarterly, and again immediately after any real incident or near miss, following CISA’s recommended review cadence. Treat it as a living document tied to your NIST or CIS IG1 maturity, not a one-time project you file away.