Quick answer: Start cybersecurity with the basics that prevent common account takeovers and reduce the damage of mistakes: unique passwords, multifactor authentication, timely updates, tested backups, limited access, and a simple incident plan.
Small businesses often assume attackers only target large companies. In practice, any organisation with email, customer information, payments, or online accounts has something worth protecting. You do not need a large security department to make meaningful improvements.
The 10-step checklist
1. Turn on multifactor authentication
Enable MFA on email, domain registrar, hosting, payment, cloud storage, and administrator accounts. Use phishing-resistant methods where supported and store recovery codes securely. Protect the email account used to reset other passwords first.
2. Use unique passwords and a password manager
Never reuse the same password across business services. A reputable password manager can create and store strong, unique credentials and help teams share access without sending passwords in chat messages.
3. Update devices and software
Install operating-system, browser, router, plugin, and application updates promptly. Remove software that is no longer supported and delete unused accounts. For WordPress sites, keep core, themes, and plugins updated, but take backups and test changes responsibly.
4. Limit access by role
Give staff only the permissions needed for their work. Review administrator accounts regularly and remove access promptly when a person leaves or changes role. Use separate accounts instead of sharing one administrator login.
5. Train staff to spot phishing
Teach people to inspect sender addresses, verify unexpected payment changes through a separate channel, and avoid opening suspicious attachments. Attack messages may look polished and may reference real projects. Encourage staff to report a mistake quickly rather than hide it.
6. Back up important data
Keep backups of business files, customer records, and website data. Store at least one backup separately from the main account so a compromised account cannot easily delete every copy. Test restoration; a backup that cannot be restored is not a reliable recovery plan.
7. Secure the router and Wi-Fi
Change default administrator credentials, install firmware updates, use modern Wi-Fi encryption, and set up a guest network for visitors where practical. Avoid managing sensitive business accounts over untrusted public Wi-Fi unless you have appropriate protection.
8. Protect customer and payment data
Collect only the information you need, restrict who can access it, and understand your vendors’ data practices. Do not store payment details in spreadsheets or email. Use reputable payment processors and follow applicable legal and contractual requirements.
9. Monitor important accounts
Review sign-in alerts, billing changes, new administrator accounts, forwarding rules, and unexpected domain or hosting changes. Set recovery contacts and ensure more than one trusted person can reach critical business assets without sharing credentials insecurely.
10. Write a one-page incident plan
Record who to contact, how to suspend compromised accounts, where backups live, and how to reach your hosting or payment provider. If an incident occurs, use a trusted device to secure accounts, preserve relevant evidence, and seek professional help when needed. Legal notification duties vary by location and data type.
A 30-minute first-day plan
- Enable MFA on the primary business email and website administrator account.
- Replace reused passwords for critical services.
- Check that software updates and automatic backups are enabled.
- Review administrator users and remove accounts no longer needed.
- Save a short incident contact list somewhere accessible offline.
If your business uses AI or connected automation, review the permissions those tools receive. Avoid giving a workflow broad access when it only needs to read one folder or create one type of record. Our guide to AI automation tools for small businesses covers why integrations and data handling deserve attention.
Frequently asked questions
What is the first security step for a small business?
Secure the primary email and administrator accounts with unique passwords and MFA, then confirm backups and update routines.
Does antivirus alone protect a business?
No single product covers every risk. Security works best as layers of account protection, updates, backups, access controls, training, and recovery planning.
