Guide · 2026
SMB cybersecurity checklist 2026
Twelve items for a small company. None of them are a product pitch. Do them in order if you are starting from zero. The mailbox comes first.
- 1
Multi-factor authentication
Turn it on for email and for every login that can pay a bill or change payroll. The owner’s account is not exempt.
- 2
Separate admin accounts
Daily mail and company administration should not be the same login. Name two people who hold admin rights.
- 3
Updates
Laptops, servers, and the firewall get patches on a schedule, not when someone remembers.
- 4
A backup you have restored
Servers and Microsoft 365. A job that has never been restored is not evidence. Write down the last test.
- 5
Email that can spot a fake
Filtering in front of the mailbox, plus a rule that a payment-detail change gets a phone call to a number you already had.
- 6
Sharing that matches the audience
Company files default to people inside the company. Public links are a choice. Clean this up before any AI tool is turned on.
- 7
A list of vendors who can get in
The MSP, the accountant, the software host. If they can sign in, they belong on a list someone reviews.
- 8
Devices you can wipe
A lost laptop should be encryptable and remote-wipeable. Personal phones with company mail belong in the same conversation.
- 9
A way to report a weird message
Staff should be able to forward a suspicious email without a lecture. The sentence is “send it before you click.”
- 10
An incident note
Who to call, what to unplug, and how you tell customers. One page is enough to start.
- 11
Insurance answers you can stand behind
If a carrier asks about MFA, backups, and training, the answers should match what is actually on.
- 12
A person in charge
Even if that person is an outside team. Put the number where the office can find it on a Friday afternoon.