Small-business security self-check

One named person is responsible for cybersecurity and has a budget for it.

You have short written policies (acceptable use, devices, access and offboarding, retention, incident reporting) that staff have signed.

You keep a current list of devices, accounts, data and vendors, and know which matter most.

You know which cloud services hold business data, and which security settings are your responsibility rather than the provider’s.

Multifactor authentication (MFA) is on for every email account.Start here

MFA is also on for banking, payroll, cloud storage, remote access and every administrator account.Start here

Administrators and finance staff use phishing-resistant MFA (security keys or passkeys) where the service supports it.

Text-message or voice codes are used only where nothing stronger is available.

Everyone uses long, unique passwords stored in a company password manager.

You don’t force scheduled password changes, but change passwords immediately when a compromise is suspected.

Automatic updates are on for operating systems, browsers and apps.Start here

Departing employees’ accounts are disabled on or before their last day, using an offboarding checklist.Start here

Staff get short, regular security-awareness refreshers, not just a yearly slideshow.

Changes to payment or bank details are verified by calling a known number, and new payees need a second person’s approval.

Staff know how to report a suspicious email or unexpected MFA prompt, and honest reports aren’t punished.

Someone reviews backup job reports and security alerts regularly (for example weekly).

You have a short written incident response plan with roles and contacts, kept somewhere that works if email is down.

You’ve walked through that plan in a tabletop exercise within the past year.

You know when you’d contact your bank, insurer, attorney and law enforcement (such as the FBI’s IC3).

Important data is backed up often enough to meet how much data you can afford to lose (your RPO).Start here

At least one backup copy is offline or immutable, and the backup system has its own credentials protected by strong MFA.

You test restores — some files monthly, a full system at least quarterly — and the time fits how long you can be down (your RTO).Start here

Cloud apps such as email, files and CRM have their own backup, beyond the provider’s built-in protection.