Small-business cyber security checklist
A practical, defensive checklist covering passwords, MFA, patching, backups, staff awareness and incident preparation.
Safety rule: security learning here is for systems you own or are explicitly authorized to test. The goal is prevention, secure development and responsible reporting.
1. Protect accounts first
Use unique passwords, a password manager, and multi-factor authentication on email, hosting, cloud and admin accounts.
2. Keep software current
Patch operating systems, CMS plugins, apps and network devices on a defined schedule.
3. Back up what matters
Keep tested backups with at least one copy separated from the main system, and verify that restoration actually works.
4. Limit access
Give staff only the access required for their role and remove old accounts promptly.
5. Prepare for mistakes
Write down who to contact, what to disconnect, and how to preserve logs or evidence if something suspicious happens.