A small-business cybersecurity checklist turns a broad concern—“Are we protected?”—into specific actions your team can verify. It helps you secure employee accounts, laptops, email, financial processes, business data, and your ability to recover after an incident.

Consider a common scenario: your bookkeeper receives an urgent email that appears to come from a trusted vendor. The invoice looks familiar, but the sender asks to route payment to a new bank account. Whether that request becomes a costly loss depends on more than one security tool. It depends on email protections, employee training, and a payment-verification process that does not rely on the email itself.

Use this 2026 cybersecurity checklist to identify gaps, assign ownership, collect evidence, and prioritize improvements across the systems your business uses every day. It is designed for small and midsize businesses in Pocatello, Idaho Falls, and across Idaho—and can be adapted to other locations and business environments.

The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide provides a foundation for identifying and managing cyber risks. Use this checklist to turn that review into responsibilities and next steps for your business.

Adjust the checklist to the information you handle, the systems you depend on, and any industry-specific requirements. Some controls will need technical review before you can mark them as verified.

How to use this checklist

For each item, record:

Field What to document
Status Verified, Needs Work, or Unknown
Owner The employee, IT provider, or vendor responsible
Evidence A configuration report, policy, ticket record, test result, or other proof the control works
Target date The planned completion or review date
Notes Exceptions, dependencies, risks, and next steps

 

Treat unknown as a follow-up task. Do not assume a control is in place simply because a tool was purchased, a dashboard exists, or a policy was written years ago.

A quarterly management review is a useful starting point. Adjust the schedule to your risk and review the checklist after significant changes or incidents. Urgent updates, access removal, and security alerts need attention between reviews.

The 15-point cybersecurity checklist

  1. Keep an inventory of business devices and applications

Why it matters: You cannot secure devices, accounts, and software that nobody knows exist. Unmanaged laptops, old mobile devices, unsupported applications, and unused cloud subscriptions can become easy entry points for attackers.

What to verify: Maintain an inventory of company computers, phones, tablets, servers, network equipment, printers, cloud services, business applications, and approved personal devices used for work. Include software employees may have purchased independently.

Record the business owner, primary user, location, operating system, support status, and whether each item receives security updates.

Evidence to collect: Asset inventory, software inventory, device-management reports, cloud-service subscription list, and assigned owners.

Checklist question: Can your team identify every device and application that stores, processes, or accesses important company information?

  1. Require MFA for high-impact accounts

Why it matters: Multifactor authentication adds another verification step beyond a password. MFA can help prevent unauthorized access when a password is stolen or reused, though no authentication method removes every risk.

What to verify: Enforce MFA for:

  • Business email and Microsoft 365 accounts
  • Administrator and privileged accounts
  • Banking, payroll, accounting, and payment platforms
  • Remote-access tools
  • Cloud storage and file-sharing systems
  • Password managers
  • Customer relationship management and line-of-business systems

Use phishing-resistant MFA—such as FIDO2 security keys or passkeys—where supported, especially for administrators and other high-impact accounts.

Evidence to collect: MFA enforcement policies, conditional-access rules, system lists, administrator-account records, exception approvals, and recovery procedures.

Checklist question: Is MFA enforced—not merely available—for every high-impact account, including administrators and remote users?

CISA recommends MFA for business accounts and encourages phishing-resistant methods.

  1. Use unique passwords and a business password manager

Why it matters: Reused passwords create a chain reaction: one compromised account can expose other systems if employees use the same password in multiple places. Credentials shared through spreadsheets, email, text messages, or unapproved notes are difficult to control and audit.

What to verify: Give each employee an individual account whenever possible. Require long, unique passwords and use an approved business password manager for secure credential storage and controlled sharing.

Protect the password manager with MFA. Establish a documented recovery process so access can be restored without exposing the entire password vault. Shared credentials should have a named owner, restricted access, and a review schedule.

Evidence to collect: Password-manager deployment records, MFA settings, shared-vault access list, recovery procedure, and offboarding workflow.

Checklist question: Can employees access the credentials they need without broadly sharing passwords?

For additional guidance, review MOATiT’s business password-management guide.

  1. Limit administrator privileges and unnecessary access

Why it matters: Administrator privileges can allow changes to accounts, security settings, software, and sensitive systems. Compromise of a privileged account can therefore have a wider impact.

What to verify: Review administrative rights across computers, Microsoft 365, cloud services, accounting systems, file storage, network equipment, and security platforms.

Use separate administrator identities for privileged work where appropriate. Use standard accounts for routine email, browsing, and documents.

Remove unnecessary access after job changes, role changes, completed projects, and vendor engagements.

Evidence to collect: Privileged-account list, access-review records, approval workflow, role-based access matrix, and contractor access records.

Checklist question: Who can change security settings, export sensitive data, create accounts, or grant someone else access—and why?

Learn more about role-based access management.

  1. Establish a reliable software-update process

Why it matters: Attackers frequently exploit known vulnerabilities in software and devices. Missed updates can leave a known weakness open to exploitation.

What to verify: Include operating systems, browsers, business applications, routers, firewalls, VPNs, wireless equipment, endpoint-protection tools, and other internet-connected systems in your update process.

Use automatic updates where appropriate, but confirm that updates actually install successfully. Prioritize actively exploited vulnerabilities, internet-facing systems, and systems that handle sensitive data.

If updates must be delayed for business compatibility testing, document the reason, assign an owner, and establish a deadline.

Evidence to collect: Patch-management reports, vulnerability scan results, update-failure reports, exception register, and device replacement plan.

Checklist question: Can IT show which devices failed updates and explain how those failures are being addressed?

CISA’s Secure Our World resources highlight software updates as a core protective action.

  1. Protect devices and assign someone to respond to alerts

Why it matters: Endpoint protection helps detect malware, suspicious activity, credential theft, and ransomware-like behavior on business devices. However, the technology only helps if someone is responsible for reviewing and responding to serious alerts.

What to verify: Confirm that approved endpoint protection covers company computers and supported mobile devices. If your business uses endpoint detection and response, or EDR, confirm that it is configured appropriately and monitored.

Define what happens when a potentially compromised device is identified. Your team should know who can isolate the device, preserve information for investigation, reset credentials, and communicate with affected users.

Evidence to collect: Endpoint coverage reports, device list, alert-routing procedures, managed-security agreement, escalation contacts, and incident tickets.

Checklist question: If a laptop triggers a serious security alert tonight, who will investigate, isolate, and document the event?

  1. Review email and Microsoft 365 security settings

Why it matters: Email remains a common channel for phishing, invoice fraud, credential theft, malicious attachments, and business email compromise. Cloud email does not automatically eliminate configuration, licensing, access, and user-awareness risks.

What to verify: Review spam, malware, and phishing protections; external forwarding rules; administrator access; mailbox auditing; legacy authentication settings; and account recovery procedures.

Consider email-domain authentication controls, including SPF, DKIM, and DMARC, with qualified IT support and testing. These controls help receiving systems authenticate mail using your domain and apply your handling policy. They reduce some spoofing risks, but do not establish that a message is trustworthy or stop every impersonation attempt.

Confirm which Microsoft 365 security capabilities your subscription includes and which settings are actually configured. Microsoft’s business security best practices explain how capabilities differ across subscriptions. Business Premium adds security and device-management features beyond Basic and Standard.

Evidence to collect: Microsoft 365 security configuration report, external-forwarding settings, administrator list, email-authentication records, conditional-access policies, and license inventory.

Checklist question: Are email and Microsoft 365 security settings reviewed and tested rather than assumed to be sufficient because email is in the cloud?

For related support, see MOATiT’s AI-powered email phishing protection.

  1. Train employees to recognize and report suspicious requests

Why it matters: Employees routinely receive fake login links, QR-code scams, unusual attachments, impersonation emails, fake support calls, and urgent financial requests. Training helps employees recognize suspicious behavior and report it quickly.

What to verify: Use short, recurring training sessions based on realistic business scenarios. Include:

  • Unexpected password-reset or sign-in links
  • QR codes in emails or documents
  • Invoice and vendor-payment requests
  • Unusual attachments and shared files
  • Executive impersonation attempts
  • Fake technical-support calls
  • Requests to bypass normal approval processes
  • Requests for passwords, MFA codes, or confidential files

Teach employees to open known services directly rather than signing in through an unexpected email link. Make reporting easy and supportive. Employees should feel comfortable reporting a mistake promptly.

Evidence to collect: Training schedule, attendance records, phishing-simulation summaries, reporting instructions, and internal awareness materials.

Checklist question: Can every employee explain how to report a suspicious email, unexpected sign-in prompt, or accidental click?

CISA’s small-business resources provide supporting awareness materials.

  1. Verify payment and bank-detail changes independently

Why it matters: Business email compromise often targets invoices, payroll, gift cards, wire transfers, and vendor bank-account changes. A convincing email from a familiar vendor, executive, or coworker is not enough to authorize a payment change.

What to verify: Require an independent verification step for:

  • New vendor bank-account details
  • Changes to existing payment instructions
  • Urgent wire-transfer requests
  • Unusual payment amounts
  • Requests that bypass standard approval rules
  • Payroll direct-deposit changes
  • Requests appearing to come from executives or business owners

Contact the vendor or colleague using a trusted phone number already on file, not a number, reply address, or website link included in the suspicious message.

Document approval thresholds, verification steps, and exceptions.

Evidence to collect: Accounts-payable policy, vendor-verification checklist, approval workflow, employee training records, and documented exceptions.

Checklist question: Would an urgent email from an executive or familiar vendor be enough to change payment information?

  1. Maintain protected backups and test restoration

Why it matters: A backup is only useful if it can be restored when a system fails, data is deleted, ransomware occurs, or a cloud-service account becomes inaccessible. Backup-success notifications do not prove that recovered files will be complete, usable, and available in time.

What to verify: Identify the systems and data your business needs to restore, including servers, workstations, accounting platforms, databases, file shares, cloud storage, Microsoft 365 data, and critical line-of-business applications.

Maintain backup copies that a compromised everyday account cannot easily alter or delete. Depending on your environment, that may involve offline, isolated, immutable, or separately protected backup storage.

Test restoration of representative files and critical systems. Record the time required, the completeness of restored information, and whether employees can actually use the recovered systems.

Evidence to collect: Backup scope, backup-job reports, restoration test results, recovery-time estimates, retention settings, and documented recovery procedures.

Checklist question: When did your business last restore important data successfully, rather than only review a backup-success message?

CISA’s StopRansomware guidance recommends maintaining and testing backups for ransomware preparedness.

For a practical next step, review MOATiT’s business backup testing checklist.

  1. Secure networks and remote access

Why it matters: Weak Wi-Fi settings, outdated network equipment, exposed remote-access services, and unmanaged remote-support tools can provide a path into business systems.

What to verify: Have IT review firewall settings, wireless security, internet-facing services, remote-access tools, and network equipment update status.

Separate guest Wi-Fi from business systems. Use network segmentation where it meaningfully reduces risk, such as isolating payment devices, guest devices, connected equipment, cameras, or other systems that do not need access to sensitive business data.

Use approved remote-access methods protected by MFA. Avoid exposing Remote Desktop Protocol, or RDP, directly to the internet. Review remote-support tools used by staff and vendors, and remove tools that are no longer necessary.

Evidence to collect: Network diagram, firewall configuration review, wireless-network configuration, remote-access inventory, vendor access list, and segmentation plan.

Checklist question: Can visitors, unmanaged devices, or former vendors reach systems that handle sensitive business information?

Explore MOATiT’s guidance on secure business networks and remote access.

  1. Protect sensitive files and control sharing

Why it matters: Sensitive information can be exposed through public sharing links, overly broad folder permissions, personal cloud-storage accounts, unapproved applications, lost devices, or accidental use of AI tools.

What to verify: Identify the types of sensitive information your business handles, including customer information, employee records, payment data, financial documents, contracts, intellectual property, and regulated records.

Store sensitive information in approved business systems. Use encryption where appropriate, review external sharing links, and limit access based on job responsibilities. Apply retention and deletion practices that match your business, legal, contractual, and industry obligations.

Set clear rules for artificial intelligence tools. Employees should know which AI tools are approved, whether business accounts are required, and what information they may not enter into an external AI service.

Evidence to collect: Data-classification guidance, file-sharing reports, folder-permission reviews, approved-applications list, AI-use policy, and retention schedule.

Checklist question: Do employees know where sensitive information belongs, which tools they may use, and who is allowed to receive it?

  1. Review vendor access and employee offboarding

Why it matters: Contractors, technology vendors, temporary employees, and former staff may retain access long after a project or employment relationship ends. Unused accounts and third-party access create unnecessary risk.

What to verify: Track access granted to contractors, vendors, outside accountants, software providers, managed-service providers, and other business partners. Record the business owner, purpose, permissions, approval date, and planned end date.

When an employee leaves, block access at the agreed cutoff, revoke sessions, and remove third-party access. Review shared credentials and recovery methods, recover company equipment, preserve required records, and transfer ownership before removing licenses or deleting accounts. Verify application-specific sessions too; blocking a Microsoft 365 sign-in does not necessarily end every application session immediately.

Follow Microsoft’s former-employee guidance for the Microsoft 365 portion. Keep a sign-in-blocked account if it is required to support a retained shared mailbox.

Evidence to collect: Vendor-access register, offboarding checklist, termination tickets, sign-in-block confirmation, application-access review, and ownership-transfer records.

Checklist question: Could a former employee, completed-project contractor, or inactive vendor still reach company information?

  1. Enable useful logging and review unusual activity

Why it matters: When an account is compromised or a device behaves suspiciously, logs help IT understand what happened, which systems were affected, and what actions are needed. Without logs, response becomes slower and more uncertain.

What to verify: Confirm that important systems record relevant events, including sign-ins, failed sign-ins, administrative changes, new privileged accounts, mailbox-forwarding rules, endpoint alerts, firewall activity, and cloud-service events.

Where practical, centralize logs so IT can investigate activity across multiple systems. Confirm how long logs are retained, who can access them, how they are protected from unauthorized deletion, and who receives high-priority alerts.

Look for meaningful signals, such as unusual sign-ins, unexpected forwarding rules, new administrative accounts, unfamiliar remote-access tools, or abnormal data exports.

Evidence to collect: Logging configuration, retention settings, monitoring dashboard, alert rules, incident tickets, escalation contacts, and access controls for log data.

Checklist question: Could your IT team reconstruct what happened if a user account, email mailbox, or device were compromised?

Use CISA’s business logging guidance to review log sources, retention, protection, and alert ownership.

  1. Prepare and practice an incident-response plan

Why it matters: During a cyber incident, employees need to know who to contact, what not to do, how to preserve evidence, and how decisions will be made. Searching for phone numbers and responsibilities during an outage wastes valuable time.

What to verify: Write down:

  • Who employees contact when they suspect a phishing email, account compromise, malware infection, or lost device
  • Who makes technical, legal, financial, and operational decisions
  • How to reach your IT provider if company email is unavailable
  • Which systems and services must be restored first
  • How to isolate affected devices and accounts
  • How to preserve relevant evidence
  • When and how to communicate with staff, customers, vendors, insurers, and advisers
  • Which cyber-insurance, legal, compliance, or regulatory contacts may be needed

Schedule a short tabletop exercise, for example annually and after major changes to your systems or response team. For example: an employee reports entering Microsoft 365 credentials into a fake sign-in page, or your accounting system becomes unavailable after a ransomware alert.

Evidence to collect: Incident-response plan, emergency contact sheet, recovery-priority list, tabletop-exercise notes, improvement plan, and cyber-insurance information.

Checklist question: Could your team begin responding to a security incident without searching for contacts, responsibilities, or recovery priorities?

Where to start when protections are missing

Do not let a long checklist delay the basics. Focus first on accounts and systems whose compromise would cause the most damage to your operations, finances, customers, or reputation.

For many small businesses, the first priorities are:

  • Enforce MFA for email, administrator accounts, remote access, financial systems, and password managers.
  • Remove unnecessary administrative privileges and deactivate old accounts.
  • Address urgent updates and replace unsupported devices or software.
  • Confirm that important data can be restored from protected backups.
  • Establish an incident contact and a simple response process.
  • Require independent verification of vendor payment or bank-detail changes.

After addressing urgent gaps, assign owners to the remaining checklist items and add realistic completion dates. When it is difficult to determine which weaknesses present the greatest business risk, an IT risk assessment for Idaho businesses can help connect technical findings to operational, financial, and compliance consequences.

Frequently asked questions

Is antivirus enough for a small business?

No. Antivirus or endpoint protection is one layer of cybersecurity, but it does not replace MFA, access controls, software updates, protected backups, employee awareness, secure email settings, payment-verification procedures, logging, and an incident-response plan.

What should be on a small-business cybersecurity checklist?

A practical checklist should cover business accounts, passwords, MFA, administrator access, software updates, endpoint protection, email security, employee training, payment controls, backups, networks, sensitive data, vendor access, logging, and incident response.

Does Microsoft 365 automatically secure a small business?

No. Microsoft 365 includes security capabilities, but protection depends on the subscription, configuration, user behavior, administrator access, device management, third-party applications, and business processes. Microsoft 365 Business plans offer different levels of security and management features, so businesses should verify which controls are available and enabled.

How often should a small business review cybersecurity controls?

Use a scheduled review that matches your risk, size, and capacity. A quarterly management review is a practical starting point for many small businesses. However, technical monitoring, critical security updates, employee offboarding, and access changes require more frequent attention.

Also review this checklist after major changes, including new software, a merger or acquisition, a new vendor, a new office, employee turnover, remote-work changes, a suspected compromise, or an insurance or compliance review.

Does completing this checklist prove compliance?

No. This checklist is a practical starting point for improving cybersecurity. Legal, contractual, insurance, industry, and regulatory requirements may require separate assessments, policies, technical safeguards, evidence, reporting, and professional advice.

What should a business do after an employee clicks a phishing link?

The employee should report the event immediately. IT should determine whether credentials were entered, whether MFA prompts were approved, whether malware was downloaded, and whether the account or device shows suspicious activity. Depending on the situation, appropriate actions may include resetting credentials, revoking active sessions, isolating the device, reviewing email forwarding rules, checking logs, and documenting the incident.

Turn checklist gaps into a security plan

A small-business cybersecurity checklist becomes a working security plan when every unresolved item has an owner and a target date, and each completed protection has evidence behind it. You do not need to fix everything in one afternoon, but you do need to understand which weaknesses could interrupt operations, expose sensitive information, enable financial fraud, or delay recovery.

MOATiT helps businesses in Pocatello, Idaho Falls, and across Idaho review IT and cybersecurity needs and prioritize practical improvements. If your team identified unknowns or unresolved items in this checklist, begin with an IT risk assessment or explore MOATiT’s cybersecurity services for Idaho businesses.

For more practical guidance on business technology, backups, cybersecurity, and everyday operations, visit the MOATiT blog.