No affiliate links or sponsorship, and no products to sell. This checklist is research-based, drawn from FTC, CISA, NIST, and FCC guidance plus Microsoft and Google admin documentation, all checked October 18, 2026. It’s general information, not legal advice or a security audit, and we did not run hands-on tests.
Quick answer
A small business cybersecurity checklist should start with five basics: multi-factor authentication on every account, a password manager with long unique passwords, automatic updates, backups kept off your network, and phishing training for everyone. Next, set up SPF, DKIM, and DMARC for your email domain, lock down Wi-Fi, limit who can access sensitive data, and write a one-page plan for what to do and whom to call if you’re hit. All of it is drawn from free FTC, CISA, and NIST guidance.
Key takeaways
- MFA first: the FTC and NIST both tell small businesses to require multi-factor authentication; CISA calls phishing-resistant MFA (FIDO/WebAuthn) the standard to aim for.
- Passwords: the FTC says at least 12 characters, never reused. NIST’s current guidance says not to force periodic password changes unless there’s evidence of compromise.
- Backups: follow CISA’s 3-2-1 rule, keep a copy that isn’t connected to your network, and test restores.
- Email: SPF, DKIM, and DMARC make it harder for scammers to spoof your domain, and a call-back rule stops most fake payment requests.
- If you’re hit: disconnect affected devices without powering them down, then report to IC3.gov, ReportFraud.ftc.gov, or CISA.
In this guide
Where to start
This week: turn on MFA for email, banking, and your website admin; enable automatic updates; and confirm you have a recent backup stored off your network.
This month: roll out a password manager, set up SPF, DKIM, and DMARC, separate guest Wi-Fi, and run a short phishing-awareness session.
This quarter: list your devices, accounts, and data; remove access people don’t need; and write and test a simple incident plan.
Small business cybersecurity checklist: the top 10
If you only do ten things, do these. Each comes from at least one US government source, linked in the last column.
| # | Task | Why it matters | Source |
|---|---|---|---|
| 1 | Require multi-factor authentication for everyone, including contractors | Stops most password-only account takeovers | FTC, NIST |
| 2 | Use a password manager; long, unique passwords (12+ characters) | Reused passwords turn one breach into many | FTC, CISA |
| 3 | Turn on automatic updates for systems, apps, and browsers | Updates carry security fixes | FTC, NIST |
| 4 | Back up regularly, keep one copy offline or off-site, and test restores | Lets you recover from ransomware without paying | CISA, FTC |
| 5 | Train staff to spot and report phishing | Most ransomware attacks start with phishing emails, per the FTC | FTC, CISA |
| 6 | Set up SPF, DKIM, and DMARC for your email domain | Makes it harder to spoof your business email | FTC |
| 7 | Change default passwords on routers and devices; use WPA2 or WPA3 | Default credentials are an easy way in | FTC, NIST |
| 8 | Give people access only to the data they need | Limits the damage from one compromised account | FTC, FCC |
| 9 | Encrypt laptops and phones (full-disk encryption) | Protects data on lost or stolen devices | NIST, FTC |
| 10 | Write an incident response plan and know where to report | Saves hours when every minute counts | FTC, CISA |
How we built this checklist
We built this checklist from free government guidance written for small businesses: the FTC’s Cybersecurity for Small Business pages, CISA’s core steps and Cyber Essentials, NIST’s CSF 2.0 Small Business Quick-Start Guide and password guidance, and the FCC’s tips, plus Microsoft and Google admin documentation for the MFA steps. All were checked October 18, 2026 (PKT). Where sources disagree, we say which one we follow and why. Nothing here comes from our own penetration tests or product trials.
Accounts, passwords, and MFA
Most small-business breaches start with a stolen or guessed login, so accounts come first.
- Require MFA everywhere it’s offered: email, banking, payroll, your website admin, cloud storage, and social accounts. The FTC lists authenticator-app codes, hardware tokens, and smartcards as examples (FTC), and NIST’s quick-start guide says to prioritize MFA on all accounts that offer it (NIST).
- Prefer phishing-resistant MFA for admins: CISA says any MFA is better than none, but phishing-resistant MFA is the standard to strive for, and FIDO/WebAuthn (security keys and passkeys) is the only widely available form (CISA).
- Use long, unique passwords: the FTC recommends at least 12 characters, suggests passphrases, says never to reuse or share passwords, and recommends limiting failed login attempts (FTC).
- Use a password manager: CISA’s core steps pair MFA with a password manager (CISA), and NIST suggests password managers to generate and protect strong passwords (NIST). Our LastPass vs 1Password comparison looks at two popular options.
Should you force password changes?
The FCC’s small-business tips still suggest changing passwords every three months (FCC). NIST’s current Digital Identity Guidelines say systems shall not require periodic password changes, but shall force a change when there’s evidence of compromise (NIST SP 800-63B). We follow NIST: change a password when it may have leaked, not on a calendar.
Turning on MFA in Microsoft 365
If your business uses Microsoft 365 and you don’t have Conditional Access, check that security defaults are on in Microsoft Entra ID. Microsoft says they’re available at no extra cost and require all users to register for MFA, require MFA for administrators, block legacy authentication, and protect privileged actions. New tenants get them by default, with a 24-hour grace period before MFA is enforced (Microsoft Learn).
Turning on 2-Step Verification in Google Workspace
Google’s deployment steps are: tell users what’s coming, allow users to turn on 2-Step Verification in the Admin console, have them enroll (security keys, Google prompts, the Authenticator app, or backup codes), then track enrollment in the Security report before you enforce it. You can require specific methods, such as security keys, for certain groups, and Google is enforcing 2SV for administrator accounts (Google Workspace Admin Help).
Devices and software
Keep every device patched, encrypted, and protected by a password, and don’t let everyday accounts install software.
- Automatic updates: set a schedule for operating systems, apps, and browsers, and turn on automatic updates (FTC).
- Full-disk encryption on laptops and tablets protects data if a device is lost (NIST, FTC).
- Change default manufacturer passwords on routers, cameras, printers, and other devices (NIST).
- Firewalls: make sure the operating system’s firewall is on, including on home computers used for work (FCC).
- Separate accounts: give each employee their own user account, keep administrator rights to a few trusted people, and don’t let staff install software without permission (FCC).
- Mobile devices: require passcodes and encryption, and have a reporting process for lost or stolen phones (FCC).
Backups
Backups are your ransomware insurance, but only if one copy is out of an attacker’s reach and you’ve tested restoring it.
- Follow the 3-2-1 rule: keep 3 copies of important files (1 primary and 2 backups), on 2 different media types, with 1 copy off-site (CISA).
- Keep a copy off the network: the FTC recommends saving important files and a full backup to a drive or server that isn’t connected to your network (FTC).
- Automate it: the FCC suggests backing up automatically if possible, or at least weekly, and storing copies off-site or in the cloud (FCC).
- Test restores: NIST’s quick-start guide says to back up regularly and test your backups (NIST).
Cloud sync isn’t the same as backup: if a file is encrypted or deleted on your laptop, the change can sync to the cloud too. Our explainer on what OneDrive is touches on OneDrive’s version history and ransomware protection.
Email and phishing
Email is where most attacks start, and where a few settings and one rule prevent a lot of loss.
- SPF, DKIM, and DMARC: if your email uses your own domain, make sure your provider sets up all three. The FTC explains that they let receiving servers verify your mail and block or quarantine imposters, and notes that configuration takes some expertise (FTC). For the deliverability side, see our guide on keeping your emails out of spam.
- Verify payment requests: require a phone call to a known number before acting on any emailed request to change bank details or send a wire (FTC).
- Train regularly: show staff the signs (urgency, odd sender addresses, links to log-in pages) and consider phishing simulations (FTC).
- Make reporting easy: staff should know how to report suspicious emails. The FTC suggests forwarding phishing emails to [email protected] and reporting to ReportFraud.ftc.gov (FTC).
Wi-Fi and remote access
- Secure the router: change the default username and password, turn off remote management, and log out of the admin account (FTC).
- Encryption: use WPA2 or WPA3, and protect the network with a strong password (FTC).
- Separate networks: keep guests and personal devices on a separate network from business devices (FTC).
- Remote work: require secure connections, consider a VPN for employees and vendors, and stop phones from auto-joining public Wi-Fi (FTC).
- Payments: isolate payment systems from other programs, and don’t use the same computer to process payments and browse the web (FCC).
Data, access, and vendors
- Keep only what you need: shred unneeded paper records and wipe devices properly; “delete” alone doesn’t necessarily remove files (FTC).
- Least privilege: restrict sensitive information to the people who need it for their jobs (NIST).
- Encrypt sensitive data at rest and in transit, including files you send to outside parties such as your accountant (FTC).
- Vendors: put security requirements in contracts, give vendors only the access they need for as long as they need it, and require MFA for their access (FTC).
- Your web host: ask whether TLS (https) is included, who keeps software updated, whether MFA is available for logins, and whether they can help with SPF, DKIM, and DMARC (FTC).
People, policies, and insurance
- Write a short security policy and share it with everyone; NIST’s Govern function covers setting and communicating policy (NIST).
- Know your requirements: document legal, regulatory, and contractual cybersecurity obligations (FTC).
- Use free starter material: CISA’s Cyber Essentials is a guide for small-business leaders on where to start (CISA), and NIST’s Small Business Cybersecurity Corner added a finder for regional support programs on October 5, 2026.
- Consider cyber insurance: the FTC suggests checking whether a policy covers breaches at vendors, ransomware, and attacks from inside and outside the US, and whether it offers a 24-hour breach hotline (FTC).
If something goes wrong
Have these steps on one page before you need them.
- Contain it: disconnect infected devices from the network without powering them down, because some evidence may be lost if you turn them off (FTC).
- Change compromised passwords and follow your incident plan, including who to call for IT help (FTC).
- Report it: the FTC points businesses to the FBI’s IC3.gov and ReportFraud.ftc.gov for spoofing and scams, and to the local FBI office for ransomware (FTC). CISA also asks organizations to report cyber incidents (CISA).
- Ransom demands: the FTC notes law enforcement doesn’t recommend paying, and paying doesn’t guarantee you’ll get your data back (FTC).
- Notify affected people if personal information was exposed (FTC). State breach-notification laws vary, so get legal advice.
Watch for follow-up scams
IC3 says it will never contact you directly for information or money. If someone claiming to be from IC3 contacts you, treat it as a scam (IC3).
How this checklist maps to NIST CSF 2.0
NIST’s Cybersecurity Framework groups security outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. NIST’s free quick-start guide for small businesses is a supplement to the full framework and a good discussion tool with an IT provider (NIST SP 1300).
| Function | What it means for a small business | Checklist items |
|---|---|---|
| Govern | Set your security strategy, policy, and requirements | Written policy, known obligations, insurance decision |
| Identify | Know what you have and what’s at risk | Inventory of devices, accounts, data, and vendors |
| Protect | Put safeguards in place | MFA, password manager, updates, encryption, backups, training |
| Detect | Spot problems early | Alerts on unusual logins, checking for unknown devices |
| Respond | Act on an incident | Incident plan, contacts, reporting steps |
| Recover | Restore operations | Tested backups, customer communication, lessons learned |
Checklist schedule
| How often | Task |
|---|---|
| Once (then on every new hire or device) | MFA on, password manager set up, separate user accounts, device encryption, default passwords changed |
| Weekly (automated) | Backups run; updates install |
| Monthly | Check backup reports; review admin accounts and remove leavers; check for unknown devices on Wi-Fi |
| Quarterly | Test a restore; short phishing-awareness refresher; review vendor access |
| Yearly | Review policy, incident plan, and insurance; re-check email authentication records |
FAQ
What should be on a small business cybersecurity checklist?
At minimum: multi-factor authentication, a password manager with long unique passwords, automatic updates, backups kept off your network, phishing training, email authentication (SPF, DKIM, DMARC), secure Wi-Fi, limited access to sensitive data, device encryption, and an incident response plan.
How often should employees change passwords?
Only when there’s a reason, such as a suspected leak. NIST’s current guidance says systems shouldn’t force periodic password changes but should force a change when there’s evidence of compromise. The FCC’s older tip sheet suggests every three months.
Is MFA really necessary for a small business?
Yes. The FTC and NIST both tell small businesses to require it, and CISA says any MFA is better than none. Start with email, banking, and admin accounts, and use security keys or passkeys for administrators where you can.
What is the 3-2-1 backup rule?
CISA describes it as keeping 3 copies of important files (1 primary and 2 backups), on 2 different types of media, with 1 copy stored off-site.
Where do I report a cyberattack on my business?
The FTC points businesses to IC3.gov (run by the FBI) and ReportFraud.ftc.gov, and to the local FBI office for ransomware. CISA also accepts incident reports. Report to your industry regulator too if one applies.
Is there a free cybersecurity framework for small businesses?
Yes. NIST’s Cybersecurity Framework 2.0 is free and voluntary, and its Small Business Quick-Start Guide (NIST SP 1300) breaks it into Govern, Identify, Protect, Detect, Respond, and Recover actions.
Sources
US government sources (FTC, CISA, NIST, FCC, FBI) and Microsoft and Google admin documentation only. All checked October 18, 2026 (PKT).
Show all 14 sources
- FTC: Cybersecurity for Small Business
- CISA: Cybersecurity Awareness Month (core steps for everyone and organizations)
- CISA: Cyber Essentials
- CISA: More than a Password (multifactor authentication)
- CISA: Data Backup Options (PDF, 3-2-1 rule)
- CISA: Report a cyber issue
- NIST: Small Business Cybersecurity Corner
- NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide (PDF)
- NIST SP 800-63B-4: Digital Identity Guidelines, Authentication (passwords)
- FCC: Cybersecurity for Small Businesses (10 tips)
- Microsoft Learn: Security defaults in Microsoft Entra ID
- Google Workspace Admin Help: Deploy 2-Step Verification
- FBI: Internet Crime Complaint Center (IC3)
- FTC: ReportFraud.ftc.gov
Changelog
- October 18, 2026: First published. Checklist items checked against FTC, CISA, NIST (SP 1300 and SP 800-63B-4), and FCC guidance plus Microsoft Entra security defaults and Google Workspace 2-Step Verification documentation. No hands-on testing.
Related reads
