Small Business Cybersecurity Checklist for 2026: Step by Step

Why small businesses are targets

Many owners assume attackers only go after big companies. In reality, small businesses are attractive because they often have weaker defenses but still hold money, customer data and access to larger partners.

Why it matters: a single breach can mean lost money, days of downtime, legal costs and damaged trust. For a small company, that can be enough to close the doors.

By the numbers: Verizon's 2026 Data Breach Investigations Report, which analyzed more than 22,000 breaches, found that exploiting software vulnerabilities overtook stolen credentials as the top initial access route for the first time, accounting for roughly 31% of breaches.

The small business cybersecurity checklist

Work through this list over a month. Tick each item off as you complete it, then review the whole list every quarter.

1. Accounts and passwords

• ☐ Turn on two-factor authentication (2FA) for email, banking, payroll, accounting, cloud storage, your website and your domain registrar. Our guide to two-factor authentication for business shows how.
• ☐ Move to passkeys where services support them; they stop most phishing attacks.
• ☐ Use a business password manager so every account has a long, unique password.
• ☐ Give each person their own login; avoid shared accounts wherever possible.
• ☐ Remove access the same day someone leaves the business.
• ☐ Limit admin rights to the few people who really need them.

2. Software updates

• ☐ Turn on automatic updates for operating systems on every computer and phone.
• ☐ Keep browsers, office apps and security software updated automatically.
• ☐ Update your website software, plugins and themes, or choose a host that does it for you.
• ☐ Update routers, firewalls and other network devices, and change their default passwords.
• ☐ Replace devices and software that no longer receive security updates.

3. Backups

• ☐ Back up important data automatically every day.
• ☐ Follow the 3-2-1 rule: three copies, on two types of storage, with one copy offsite or offline. Our guide to business data backup explains it step by step.
• ☐ Make sure at least one backup cannot be changed or deleted from your normal computers, so ransomware cannot reach it.
• ☐ Test restoring a file and a full system at least twice a year.

4. Email and phishing

• ☐ Use a business email service with spam and malware filtering turned on.
• ☐ Set up SPF, DKIM and DMARC records for your domain so others cannot easily send email pretending to be you.
• ☐ Train staff to check sender addresses, hover over links and never enter passwords after clicking an email link.
• ☐ Create a rule: any request to change bank details or make an urgent payment is confirmed by phone using a known number.
• ☐ Make it easy and blame-free for staff to report suspicious emails.

5. Devices and network

• ☐ Turn on full-disk encryption on all laptops and phones (built into Windows, macOS, iOS and Android).
• ☐ Require a screen lock with a PIN, password or biometric on every device.
• ☐ Use the security software built into your operating system, or a reputable business product, on every computer.
• ☐ Secure office Wi-Fi with WPA2 or WPA3 and a strong password; give guests a separate network.
• ☐ Make sure lost or stolen devices can be located and wiped remotely.

6. Data and customers

• ☐ Know where customer data lives: CRM, email, spreadsheets, payment systems.
• ☐ Collect only the data you need, and delete what you no longer use.
• ☐ Restrict who can access sensitive data, such as payroll and customer financial information.
• ☐ Check that your website uses HTTPS and that forms send data securely.
• ☐ Review your obligations under privacy laws such as GDPR and CCPA; our GDPR guide for small business covers the basics.

7. Suppliers and software

• ☐ List the outside services that hold your data or access your systems, such as IT providers, accountants and software tools.
• ☐ Check that key suppliers use 2FA and have basic security practices.
• ☐ Remove apps and integrations nobody uses; each one is a possible door into your systems.

8. Incident plan

• ☐ Write a one-page plan: who to call, how to disconnect affected devices, how to reach your bank and IT support.
• ☐ Keep the plan and key phone numbers on paper, in case systems are down.
• ☐ Check whether you need cyber insurance and what it covers.
• ☐ Know your legal duties to report breaches to customers or regulators in the countries where you operate.

Where to start if you only have one day

If the full checklist feels overwhelming, these five actions give the biggest protection for the least effort:

1. Turn on 2FA for email, banking and your domain registrar.
2. Turn on automatic updates on every device.
3. Set up automatic backups with one copy offline or immutable.
4. Agree a phone-check rule for payment and bank detail changes.
5. Remove accounts for anyone who has left the business.

How much does small business cybersecurity cost?

Many essentials are free or included in tools you already pay for: 2FA, automatic updates, disk encryption and built-in security software. Typical paid items include a business password manager, a backup service and, for some businesses, managed IT support or cyber insurance. For a small team, a solid baseline is often achievable for a modest monthly cost per person. Compare that with the cost of a single day of downtime.

Yes, but: no tool replaces good habits. Most successful attacks still involve someone clicking a link, reusing a password or skipping an update.

Ransomware deserves special attention because it can stop a business completely. Our analysis of ransomware protection for small business explains what works.

What to watch: attackers increasingly use AI to write convincing phishing emails and fake voices. Payment verification rules matter more than ever.

How to train your team in 30 minutes

Technology blocks many attacks, but people stop the rest. A short, regular session works better than a long annual lecture.

1. Show three real examples: a phishing email, a fake invoice and a fake "urgent request from the boss". Ask the team to spot the warning signs.
2. Explain the payment rule: any change to bank details or any urgent payment request is confirmed by phone using a known number.
3. Practice reporting: show exactly how to report a suspicious email and promise that reporting a mistake will never be punished.
4. Check sign-in security together: make sure everyone has 2FA or passkeys set up on their work accounts.

Repeat every quarter with new examples, and include the session in onboarding for every new hire.

Extra steps for remote and hybrid teams

When people work from home, cafés or while traveling, a few more items belong on the checklist:

• ☐ Ask staff to change the default password on their home router and keep its software updated.
• ☐ Avoid public Wi-Fi for sensitive work, or use a trusted VPN or phone hotspot.
• ☐ Keep work files in approved cloud storage rather than on personal devices or USB drives.
• ☐ Lock screens when stepping away, even at home.
• ☐ Use company-managed devices for work where possible, so updates and encryption can be enforced.

The bottom line: A small business cybersecurity checklist is not a one-time project. Lock down sign-ins, keep software updated, back up properly and train your team, then review the list every quarter. These basics stop most attacks before they start.

Frequently asked questions

What is the most important cybersecurity step for a small business?

Turning on two-factor authentication or passkeys for email and financial accounts. Email is the key to resetting almost every other account, so protecting it protects everything else.

Do small businesses need antivirus software?

Every computer should run up-to-date security software. The protection built into current versions of Windows and macOS is a solid baseline for many small businesses, combined with updates and safe habits.

How often should we train staff on cybersecurity?

A short session every quarter, plus training for every new hire, keeps phishing and payment scams top of mind without taking much time.

Do I need cyber insurance?

It depends on your risks and contracts. Some clients require it. Insurers usually ask about controls such as 2FA and backups, so completing this checklist can also help you qualify.

How long does it take to complete this checklist?

Most small businesses can complete the core items in a few weeks, working through one section at a time. The quick-start list of five actions can be done in a single day.

Who should be responsible for cybersecurity in a small business?

Name one person, often the owner or office manager, to own the checklist and review it every quarter, even if an outside IT provider does the technical work.