Small Business Cyber Security Checklist: 20 Checks

Most small firms are not breached by clever attackers but by a reused password on the email account, a payment request nobody checked, or a backup that was plugged in when ransomware arrived. This checklist gives a small business, typically up to around 50 people with no dedicated security staff, twenty checks it can work through and record in an afternoon or two. Each check is drawn from the UK NCSC's Small Business Guide, the Cyber Essentials technical requirements and the US Federal Trade Commission's small business cyber security advice, and each says what "done" looks like. It is written for owners, office managers and whoever "does the IT", and it works as an internal audit you repeat every six months. For background on the threats, read the Small Business Cybersecurity Basics Guide; for a general hygiene list for larger teams, the Cyber Hygiene Checklist Guide.

How to use this template

Copy the checks into a spreadsheet or print this page. For each check record Status (Done, Partly, Not started, Not applicable), Owner, Evidence (a screenshot, a setting, a date) and Next review.
Replace [Business] and other bracketed text with your own details. If an IT provider or managed service provider (MSP) runs your systems, send them the checks marked (provider) and ask for evidence, not a yes.
Work in order. Sections 1 to 3 stop the most common small business losses; do them first, even if the rest waits a month.
A check marked Not applicable needs a one-line reason. "We are too small" is not a reason: attackers use automated tools and do not choose targets by size.
Repeat the full checklist every [six] months and after any incident, office move, new system or change of IT provider.

1. Know what you have and who looks after it

#	Check	Done looks like
1	Name one person who is accountable for cyber security at [Business], with time set aside for it.	A named owner, written down, with a deputy for holidays.
2	List your important online accounts and who controls them: email, banking and finance, HR and payroll, online storage, website and domain hosting, social media, point of sale. These are the accounts the NCSC tells small organisations to secure first.	A list with account owner, admin users and recovery email or phone for each. The domain registrar and email admin accounts are not tied to one person's personal email.
3	List every laptop, desktop, phone and tablet used for work, including personal devices that access business email or files, and every IT provider or software supplier with access to your systems.	A device list with owner and operating system, and a supplier list with what each can reach.

2. Secure email and important accounts

#	Check	Done looks like
4	Turn on passkeys where the service supports them, otherwise two-step verification (2SV, also called MFA), on every email account and every account from check 2. The NCSC calls 2SV one of the most effective ways to protect accounts that still use passwords, and Cyber Essentials requires MFA for all cloud services.	Every account on the list shows passkeys or 2SV enabled. Prefer an authenticator app or passkey to SMS, and store backup codes safely.
5	Give each person their own login. No shared mailboxes or admin accounts with a shared password.	Shared accounts removed or converted to delegated access, so actions can be traced to a person.
6	Use a password manager and a unique password for every account. Cyber Essentials sets a minimum of 12 characters (or 8 with a block list of common passwords) and says not to force regular password changes or complexity rules.	A business password manager in use; reused passwords on email and banking changed.
7	Use a standard (non-administrator) account for daily work; keep admin rights for installing software and changing settings.	Staff log in day to day without admin rights; admin accounts are separate and protected with 2SV.
8	Remove access for leavers, former contractors and old suppliers on their last day, and review who has access to important accounts every few months, as the NCSC recommends.	A leaver step in your offboarding list; a dated access review.

See the Small Business Identity and Access Security Guide and the Password Manager Setup Guide.

3. Protect payments and spot attacks

#	Check	Done looks like
9	Require a phone call to a number you already hold, not one in the message, before paying a new supplier, changing a supplier's bank details or acting on an urgent payment request by email. The FTC recommends this call-back for wire transfer requests.	A written payment rule, known to everyone who can pay invoices, with a second approver above [amount].
10	Brief staff on the signs of phishing and of an account takeover: unexpected attachments, generic greetings, links to unknown sites, login alerts you do not recognise, customers receiving emails you did not send. Repeat at least yearly and record who attended.	A short session or video, an attendance record, and staff who know how to report.
11	Set up SPF, DKIM and DMARC for your email domain, as the FTC advises for any business sending email from its own domain. If you do not know how, ask your email or domain provider. (provider)	All three records published; DMARC moving from monitoring towards a reject policy.
12	Decide how suspicious messages are reported: internally to [owner], and externally (UK: the NCSC suspicious email reporting service; US: ReportFraud.ftc.gov).	Staff know where to forward a suspicious message and are thanked, not blamed, for reporting.

See the Invoice Redirection and Supplier Bank Detail Fraud Guide and the DMARC, SPF and DKIM Guide.

4. Protect devices

#	Check	Done looks like
13	Turn on automatic updates for operating systems, browsers and apps. Cyber Essentials requires updates rated critical or high risk (CVSS v3 7 or above, or with no severity given) to be installed within 14 days of release. Replace devices and software that no longer receive updates.	Automatic updates on; no unsupported operating systems on the device list.
14	Lock every device with a PIN of at least 6 digits or a password, and limit guesses (Cyber Essentials: no more than 10 attempts in 5 minutes, or lock after 10 failures). Encrypt laptops and phones, as the FTC recommends.	Screen lock, encryption and, where available, remote locate and wipe confirmed on each device.
15	Confirm malware protection is switched on (built-in antivirus is fine on Windows and Mac) and the software firewall is on. Install apps only from official stores or vendor websites; remove software you no longer use.	Protection and firewall on for every device; unused apps removed.

See the Small Business Device Management Guide.

5. Secure the office network and remote working

#	Check	Done looks like
16	Change the default admin password on the router and Wi-Fi, turn off remote administration unless needed, use WPA2 or WPA3, and put guests and personal devices on a separate network. These are FTC recommendations; Cyber Essentials also requires default firewall passwords to be changed and unauthenticated inbound connections to be blocked. (provider)	Router admin password changed and stored in the password manager; guest network separate.
17	Protect remote access: no remote desktop exposed directly to the internet, and 2SV on any remote access tool or VPN. (provider)	Your provider confirms in writing what is reachable from the internet and how it is protected.

See the Wi-Fi Security Guide.

6. Back up and plan for a bad day

#	Check	Done looks like
18	Back up everything the business needs to run (email, documents, invoices, customer data, website), ideally twice: online storage protected with 2SV, plus a device kept disconnected when not in use. The NCSC warns that connected backup drives can be infected too.	Two backups, one offline or immutable, with a named owner.
19	Test a restore at least every [three] months: pick a file and a mailbox and get them back.	A dated record of a successful restore and how long it took.
20	Write a one-page incident plan: who decides, who to call (IT provider, bank, insurer, solicitor), how to keep trading, and when to notify customers or a regulator (UK: personal data breaches to the ICO within 72 hours where required). Check whether your cyber insurance requires you to call a hotline first.	A printed plan with phone numbers, kept somewhere other than the systems it protects.

See the Small Business Incident Response Guide and the Ransomware Basics for Small Businesses Guide.

7. Suppliers and IT providers

Many small firms outsource most of the checks above. That moves the work, not the responsibility. Before signing or renewing with an IT provider, MSP or web host, ask for:

Access: which of their staff can reach your systems, how their accounts are protected (2SV as a minimum) and how access is removed when they leave.
Evidence: a monthly or quarterly report covering updates applied, backup tests and devices out of support.
Contract terms: security requirements written into the contract, access limited to the data they need, and how they will tell you about a breach on their side, as the FTC recommends.
Certification: whether they hold Cyber Essentials or Cyber Essentials Plus themselves.

See Choosing an IT Support Provider or MSP Securely.

Implementation guidance

Where to start if you have one hour: checks 4 (2SV on email and banking), 9 (call-back rule for payments) and 18 (one backup that is not permanently connected). Together they address account takeover, invoice fraud and ransomware.

Checks	NCSC Small Business Guide section	Cyber Essentials control
4 to 8	Secure your email; Secure your important online accounts	User access control
9 to 12	Spotting cyber attacks	Not a technical control (process)
13 to 15	Protecting your devices	Security update management; Secure configuration; Malware protection
16, 17	Protecting your devices	Firewalls; User access control
18, 19	Backing up your data	Not a technical control (resilience)

Going further with Cyber Essentials: once checks 4 to 8 and 13 to 17 are done, you are close to the five Cyber Essentials controls (firewalls, secure configuration, security update management, user access control, malware protection). The NCSC lists self-assessed Cyber Essentials from £320 plus VAT, priced by organisation size; Cyber Essentials Plus adds independent technical testing. The requirements cited here are from version 3.2 (April 2025); check the NCSC site for the current version before you apply. See the Cyber Essentials Readiness Checklist.
US firms: the FTC's advice maps to the NIST Cybersecurity Framework 2.0 functions Govern, Identify, Protect, Detect, Respond and Recover. Section 1 here is Govern and Identify; sections 2 to 5 Protect; check 10 Detect; section 6 Respond and Recover.
Measure it: track four numbers each review: percentage of important accounts with 2SV or passkeys; devices on supported, updated software; days since last successful restore test; leavers whose access was removed on their last day.
Common mistakes: 2SV on email but not on the domain registrar or bank; backups that sync deletions or encryption straight to the cloud copy; the only admin account belonging to a founder's personal email; an IT provider with permanent remote access nobody reviews; a payment rule that staff bypass when "the director" emails urgently.

For figures on how often small businesses are attacked, see Small Business Cyber Statistics.

Small Business Cyber Security Checklist: Twenty Checks Any Small Firm Can Complete