A small business cybersecurity checklist isn't a luxury reserved for companies with a dedicated IT department. It's a practical tool for any business that holds customer data, processes payments, or relies on email to operate. That covers almost everyone. Attackers increasingly target small businesses precisely because defences tend to be thin, and a single successful breach can mean lost revenue, regulatory fines, or permanent reputational damage. The 10 measures below cover the most common attack paths without requiring specialist knowledge or large budgets.
1. Enable multi-factor authentication on every account
Multi-factor authentication (MFA) is the single highest-return security action a small business can take. It requires a second proof of identity beyond a password, usually a code sent to a phone or generated by an app like Microsoft Authenticator. Enable MFA on email, accounting software, cloud storage, and any customer-facing portal. A stolen password alone won't open those doors. Start here before anything else on this list.
2. Use strong, unique passwords for every account
Reused passwords are one of the most common reasons small business accounts get compromised. When one service leaks credentials, attackers test the same username and password combination on dozens of other platforms. That's called credential stuffing, and it works. A password manager vs passkeys debate is worth having at your business, but either option beats reusing the same password across your tools. A password manager generates and stores a unique credential for each account, so your staff don't have to memorise anything complex.
3. Keep all software and operating systems updated
Unpatched software is a gift to attackers. When a vulnerability is published, security teams and cybercriminals read the same disclosure. The race to patch versus the race to exploit starts at the same moment. Enable automatic updates on Windows or macOS devices across the business, and check that routers, printers, and point-of-sale terminals also receive firmware updates. These devices are frequently overlooked.
4. Install and maintain endpoint protection
Every device that connects to your business network is an endpoint: laptops, phones, tablets, desktops. Each one is a potential entry point. Good endpoint protection catches malware, ransomware, and suspicious behaviour before damage spreads. Choosing the best antivirus software for Windows and Mac matters more than many business owners realise. Free tools offer some baseline coverage, but business-grade solutions add centralised management, so you can see the security status of every device in one place.
5. Train staff to recognise phishing
Phishing is the starting point for a large share of small business breaches. Attackers send emails that impersonate banks, suppliers, the ATO, or even the business owner to trick staff into clicking a link or handing over credentials. Train every employee to pause before clicking, check the sender address carefully, and report anything suspicious. For a detailed breakdown of what to watch for, the guide on how to protect yourself from phishing emails and online scams covers the current tactics in plain language. Run simulated phishing tests at least twice a year.
6. Back up data regularly, and test those backups
Backups don't protect you from an attack. They protect you from the worst outcome of one. Ransomware encrypts files and demands payment to restore them. A clean, recent backup means you can recover without paying. Follow the 3-2-1 rule: 3 copies of data, on 2 different media types, with 1 stored offsite (cloud backup counts). The critical part most businesses skip is testing the restore. A backup that can't be recovered is not a backup.
7. Secure your Wi-Fi network
A business Wi-Fi network open to customers or visitors is a risk if it shares the same broadcast as internal systems. Set up two networks: one for business operations, one for guests. Use WPA3 encryption if your router supports it; WPA2 is acceptable but check for firmware updates. Change the default admin credentials on the router itself. Default usernames and passwords for common router models are publicly listed online. Attackers check them first.
8. Control who has access to what
Not every employee needs access to payroll data, customer records, or financial accounts. Apply the principle of least privilege: give each person access only to the systems and data their role requires. When a staff member leaves, revoke access immediately. Dormant accounts are frequently exploited in breaches because no one is monitoring them. Review permissions quarterly and remove anything that's no longer needed.
9. Secure your email platform
Email is the highest-volume attack surface for small businesses. Beyond phishing training, the platform itself needs hardening. If your business uses Microsoft 365, configure spam filtering, enable MFA at the tenant level, and review which third-party apps have permissions to your mailbox. Attackers frequently compromise email accounts and then use them to redirect supplier invoices or request fraudulent transfers. These attacks are called business email compromise (BEC), and they cost Australian businesses tens of millions of dollars each year.
10. Have an incident response plan
Most small businesses have no documented plan for what to do when something goes wrong. Write one before you need it. The plan doesn't need to be long. It should answer four questions: who is the first point of contact inside the business, which external parties (IT provider, insurer, legal counsel) get called and in what order, how will staff be notified, and what systems get isolated first. Practice a tabletop scenario once a year. The 30 minutes it takes to walk through a hypothetical breach will expose gaps that no checklist can anticipate.
Putting the checklist into practice
Ten measures looks like a long list. It isn't. Most can be implemented in a single day with no specialist help. MFA takes minutes to turn on. Password managers cost under $10 per user per month. Backup tools are built into Windows and macOS. The businesses that get hurt aren't the ones that tried and failed; they're the ones that assumed their size made them an unlikely target. It doesn't.
Start with items 1 and 5. MFA and phishing awareness address the two most common entry points. Everything else can follow in the weeks after. A business that completes this checklist is materially harder to breach than one that hasn't started.