Cybersecurity Checklist for Small Businesses

6. Privileged access is limited

Not every employee needs administrator rights to their computer or administrator access to cloud applications. Limiting access to only what each person needs reduces the impact of an account being compromised.

7. Shared accounts are eliminated or inventoried

Shared passwords make it impossible to track who did what. Every person should have an individual account with their own credentials.

8. Offboarding removes access immediately

A former employee's account that remains active is an open door. When anyone leaves, their accounts should be disabled and credentials changed on the same day — including email, cloud apps, and VPN.

9. Vendor access is controlled and monitored

IT vendors, software vendors, and contractors who access your systems should have time-limited, auditable access. Permanent standing access for external parties is a common overlooked risk.

10. Password requirements are enforced

Use strong, unique passwords and a password manager where appropriate. Set requirements according to the system, authentication method, and applicable guidance; do not reuse business passwords.

11. Advanced email filtering is active

Email filtering cannot catch every targeted phishing email. Advanced email security with link scanning, attachment sandboxing, and impersonation protection should be in place.

12. DMARC is configured for your domain

DMARC uses SPF or DKIM alignment with the visible From domain and a published policy to help receiving mail systems handle unauthorized use of that domain. It does not stop lookalike domains or compromised legitimate accounts. Inventory legitimate senders, validate alignment and reports, and stage enforcement to avoid disrupting legitimate mail. Implementation effort depends on the sending environment.

13. Employees have received phishing awareness training

Train employees to recognize and report suspicious messages. Review training and exercises as risks and workflows change; training does not guarantee that a phishing attempt will be recognized.

14. There is a process for reporting suspicious emails

Employees should know what to do when they receive a suspicious email — and report rather than guess. A clear reporting process (a specific email address or IT helpdesk) is the minimum.

15. Security monitoring is active

Someone — internally or through a managed security provider — is reviewing alerts from your environment. Unmonitored alerts are the same as no alerts.

16. There is a written incident response plan

When a security incident occurs is not the time to figure out who to call. A written plan should identify: who declares an incident, who is notified (including legal counsel and cyber insurance), what systems are isolated, and how business continues.

17. Cyber insurance is current and reviewed

Review coverage and application answers with your insurance adviser. Required controls, exclusions, and claim conditions vary by policy; this checklist does not determine coverage or eligibility.

18. Firewall is configured and current

All network traffic in and out of the business should pass through a configured firewall. Default configurations are often insufficient. Firewall rules should be reviewed annually.

19. Remote access uses VPN or zero-trust

Employees working remotely or from home should not connect directly to business systems over the open internet. VPN or zero-trust network access provides an encrypted, authenticated channel.

20. AI tool usage has an approved policy

Employees using public AI tools (ChatGPT, Copilot, etc.) may inadvertently share confidential client or business information. An acceptable use policy for AI tools — even a simple one — reduces this risk.