A cyber security checklist for small businesses

The short answer

Most small business security incidents come from a handful of avoidable gaps: weak or reused passwords, no multi-factor authentication, out-of-date software, no proper backup, and staff who haven't been shown what a phishing email looks like. Fixing those five things closes most of the realistic risk for a small business, and they map closely onto the five technical control areas in the UK's Cyber Essentials scheme: firewalls, secure configuration, user access control, malware protection and patch management. You don't need to be certified to benefit from the basics, though certification is useful if customers or contracts ask for it.

The checklist

Access and passwords

• Every account (email, accounting software, CRM, bank) has a unique password, not reused across sites
• A password manager is used by anyone with more than a handful of logins to remember
• Multi-factor authentication is switched on for email, accounting software, and anything holding customer or financial data
• Staff accounts are removed promptly when someone leaves
• No one is sharing a single login for a business tool; each person has their own account

Devices

• All laptops and phones used for work have a screen lock with a PIN, password or biometric
• Operating systems and apps are set to update automatically, or updates are checked for regularly
• Antivirus or built-in protection (such as Microsoft Defender) is switched on
• Lost or stolen devices can be remotely locked or wiped, particularly phones with email access
• Personal devices used for work (a "bring your own device" setup) meet the same basic standards

Backups

• Business-critical data (accounts, customer records, documents) is backed up automatically, not manually when someone remembers
• At least one backup copy is kept separately from your everyday systems, so it survives if your main systems are compromised
• A backup has actually been tested by restoring something from it, not just assumed to be working
• Cloud storage (OneDrive, Google Drive, Dropbox) is not treated as a backup on its own, since accidental deletion or a compromised account can affect it too

Email and phishing

• Staff know what a phishing email typically looks like: urgency, an unexpected attachment or link, a slightly wrong email address
• There's a simple, named way to report a suspicious email, without anyone feeling silly for asking
• Email authentication records (SPF, DKIM, DMARC) are set up correctly on your domain, which also helps your legitimate emails avoid spam folders
• Financial requests (changing bank details, urgent payments) are always verified by a second channel, like a phone call, before acting

Network and firewalls

• Your office or home router uses a strong, unique password, not the default one it came with
• Guest Wi-Fi, if offered, is separate from the network your business devices use
• Any remote access to business systems uses a secure, properly configured connection, not an open port left exposed

Policy and awareness

• A short, plain-English security policy exists and has actually been shared with the team
• New starters get a basic security briefing, not just a login and a laptop
• If you use AI tools, there's a simple rule for what data can and can't go into them; see our guides on practical AI for small businesses and using ChatGPT and Copilot safely
• Someone is named as responsible for security basics, even informally, so it isn't nobody's job

What Cyber Essentials actually covers

Cyber Essentials is a UK government-backed certification scheme built around five technical control areas: firewalls and internet gateways, secure configuration, security update (patch) management, user access control, and malware protection. It's assessed through a self-assessment questionnaire, checked by an independent certification body, and is increasingly asked for by larger clients and some public sector contracts as a baseline level of assurance. The detail of what's required is updated periodically, so check the current requirements on the official Cyber Essentials website before preparing for an assessment, rather than relying on older guidance.

Most of the checklist above gets a small business most of the way towards Cyber Essentials readiness. The gap is usually formalising what you're already doing into documented settings and policy, which is where a proper audit helps more than guessing. Whichever platform you run on, our comparison of Microsoft 365 vs Google Workspace covers the device and account controls each one offers.

Common mistakes small businesses make

• Treating backups and cloud sync as the same thing. Files syncing to OneDrive or Google Drive protects against a dead laptop, not against ransomware or an accidental mass deletion that syncs everywhere at once.
• Multi-factor authentication left off "because it's annoying." It's the single most effective control on this list relative to the effort involved, and most tools now support quick approval via a phone app rather than typing in codes.
• Assuming antivirus is "all" the protection needed. It's one layer among several; patched software, good passwords and staff awareness matter at least as much.
• No one owning the decision. In a small business, security often sits with whoever's least busy that week, which means it sits with no one. Naming a person, even part-time, changes this.
• Finding out the backup doesn't work during the incident. Test a restore occasionally, ideally when nothing is wrong, rather than discovering a gap when it matters most.

If something has already gone wrong

If you suspect a breach, act in roughly this order: change affected passwords immediately, enable or check multi-factor authentication on affected accounts, disconnect the affected device from the network if malware is suspected, check what data may have been accessed, and consider whether you need to report it. Under UK GDPR, a personal data breach that poses a risk to people must generally be reported to the Information Commissioner's Office within 72 hours of becoming aware of it; check current ICO guidance for the specific thresholds and process, since the detail is updated from time to time.

If you'd rather not do this yourself

We'll run through this checklist against your actual setup, fix the gaps that matter most, and help you get Cyber Essentials-ready if that's useful for the contracts you're chasing. Have a look at our IT support and security service, or tell us about your current setup for a free 30-minute call.