An interactive version of our small business cybersecurity checklist. Tick off controls as you implement them; progress is saved in your browser.
Why these 12 controls
Most attacks on small businesses are not sophisticated. They exploit reused passwords, missing multi-factor authentication, unpatched devices and the lack of a working backup. The controls in this checklist close the most common doors first, and most can be done in an afternoon with tools you may already pay for.
Where to start
- Turn on multi-factor authentication for email, banking and admin accounts.
- Roll out a password manager so every account gets a unique password.
- Confirm backups exist, are separate from your main systems, and can actually be restored.
- Turn on automatic updates for operating systems and browsers.
How to use this checklist
Work through the checklist with whoever manages your accounts and devices. Tick an item only when it is true for everyone in the business — a policy that applies to most people still leaves a gap. Your score updates as you go and is stored only in your browser.
Where to start if you score low
- Turn on multi-factor authentication for email, banking and admin accounts first — it blocks most account takeover attempts.
- Roll out a password manager so every account gets a unique, strong password.
- Make sure devices update automatically and run endpoint protection.
- Set up backups that are separate from your main systems, and test a restore.
- Write down who to call and what to do if something goes wrong.
Review it regularly
Repeat the checklist every quarter and whenever someone joins or leaves. Changes in staff, devices and suppliers are when gaps most often appear.
How to prioritise
Work through the checklist top to bottom: the controls are ordered roughly by how much risk they remove for the effort involved. Multi-factor authentication, a password manager, automatic updates and tested backups protect against the majority of common small-business incidents. Device management, access reviews and incident planning come next.
- Tick items only when they apply to every account or device, not just some
- Note the owner and date for each unticked item
- Re-run the checklist every quarter and after staff changes
Turning the checklist into a plan
Group unticked items into a 30-day plan: accounts in week one, devices in week two, data and backups in week three, people and process in week four. Our small business cybersecurity checklist article explains each control in more detail, with tool recommendations for each.
Frequently asked questions
Is this a compliance framework?
No. It is a practical baseline. If you need a formal standard, look at government small-business guidance in your country or schemes such as Cyber Essentials (UK).
Where is my progress stored?
Only in your browser. Clearing site data resets it.
Is this checklist enough for compliance?
No. It covers essential controls, but frameworks such as SOC 2, ISO 27001 or HIPAA have additional requirements.
Do I need an IT provider to complete it?
Most items can be done by a technically confident owner or office manager; a managed service provider can help with device management and monitoring.