Cybersecurity Checklist for Small Business: A 7-Day Plan

You know you should “do something” about cybersecurity. The problem is that most advice is written for companies with an IT department, a security team and a budget line for it. You have a business to run, a few employees and maybe a nephew who set up the Wi-Fi.

This checklist is built for that reality. It takes the free guidance published by the US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission (FTC) and the National Institute of Standards and Technology (NIST), and puts it in the order that gives you the most protection for the least effort. Each day takes roughly an hour or two. By the end of the week, you will have closed the gaps attackers exploit most often.

Small businesses often start security by buying a product. But most attacks on small firms don’t need sophisticated tools. They use stolen passwords, unpatched software, convincing phishing emails and missing backups. CISA’s guidance for small and medium businesses starts with 4 essentials for exactly that reason: phishing awareness, strong passwords, multifactor authentication (MFA) and timely software updates. CISA’s public Secure Our World campaign uses the same 4 habits.

NIST’s Cybersecurity Framework 2.0 Small Business Quick Start Guide, published in February 2024, is a helpful companion. It frames security as 6 functions: govern, identify, protect, detect, respond and recover. You don’t need to master the framework, but this checklist covers each function at a basic level.

Here is the whole week at a glance.

Day 1: Know what you’re protecting

You can’t protect what you don’t know you have. Start with a simple spreadsheet with 3 tabs:

• Accounts: email, banking, payroll, accounting, point of sale, website hosting, domain registrar, social media and any cloud apps. Note who has access to each one.
• Devices: every laptop, desktop, phone, tablet, router, printer and camera that connects to your network, plus who uses it.
• Data: where customer records, payment information, employee files and financial data live.

Then answer one question for each account: if we lost access to this tomorrow, how much would it hurt? The painful ones are your top priority for the rest of the week. Your email account usually tops the list, because it is the key to resetting passwords for everything else.

Also remove access for former employees and contractors. Old accounts with valid passwords are a quiet risk.

Day 2: Turn on multifactor authentication

MFA means a login needs something besides your password, such as a code from an app, a security key or a passkey. Even if a criminal steals the password, they can’t get in without the second factor. CISA advises using MFA on every account that supports it, starting with email, financial and social media accounts.

Turn on MFA in this order:

1. Business email (Microsoft 365 or Google Workspace admin accounts first)
2. Online banking and payroll
3. Accounting software and payment processors
4. Domain registrar and website hosting
5. Social media and everything else

Choose an authenticator app, security key or passkey over text messages where you can. Our step-by-step guide to setting up two-factor authentication walks through the major platforms.

Day 3: Fix passwords with a password manager

Reused passwords are one of the most common ways attackers get in: one site gets breached, and criminals try the same email and password everywhere else. CISA recommends passwords that are long, random and unique for each account, generated and stored with a password manager. The FTC’s small business guidance recommends passwords of at least 12 characters, and CISA’s Secure Our World campaign suggests at least 16.

• Pick a business password manager that supports shared vaults, so staff can share logins without texting them.
• Replace passwords on your Day 1 critical accounts first.
• Change default passwords on routers, printers, cameras and other devices.

If you’re unsure how they work, read how password managers work.

Day 4: Update everything automatically

Software updates fix security holes that attackers actively exploit. CISA recommends turning on automatic updates wherever possible.

• Turn on automatic updates for Windows, macOS, iOS, Android and web browsers.
• Update apps such as office suites, PDF readers and accounting software.
• Update the firmware on your router, firewall and any network devices.
• Replace devices that no longer get updates. Windows 10 reached end of support on October 14, 2025; if you still have them, see what to do about Windows 10 end of support.

Key takeaway: MFA, unique passwords and automatic updates stop a large share of everyday attacks. If you only finish Days 2 to 4 this week, you’ve already made your business a much harder target.

Day 5: Back up and test a restore

Backups are what let you recover from ransomware, a stolen laptop, a failed drive or an accidental deletion. CISA recommends the 3-2-1 rule: 3 copies of your data, on 2 different types of storage, with 1 copy kept off-site.

• Back up business files, accounting data and email.
• Keep at least one copy offline or in a cloud backup service that keeps older versions and protects them from deletion.
• Test a restore today. Pick one file and one folder and bring them back. A backup you’ve never restored is a guess, not a plan.

For a full template, see our guide on how to back up business data.

Day 6: Encrypt devices, secure your network and limit admin rights

Encrypt laptops and phones

The FTC advises encrypting devices and media that contain sensitive personal information, including laptops, phones, removable drives and cloud storage. Turn on BitLocker or Device Encryption on Windows and FileVault on Mac, and require passcodes on phones. Store recovery keys in your password manager.

Secure your Wi-Fi and firewall

• Use WPA3 (or WPA2 if devices don’t support it) with a strong Wi-Fi password.
• Put guests and smart devices on a separate guest network.
• Change the router admin password and turn off remote administration.
• Make sure the built-in firewall is on for every computer.

Limit admin rights

Give employees standard accounts for daily work and keep administrator accounts for installing software and changing settings. If malware runs under a standard account, it can do far less damage.

Day 7: Train your team and plan for a bad day

Train staff on phishing

Phishing is still one of the most common ways attacks start. Spend 30 minutes showing staff real examples, how to check a sender’s address, how to hover over links and what to do with suspicious messages. Make reporting easy and blame-free. Set a rule that any request to change bank details or send money must be confirmed by phone using a number you already have, never the number in the email.

Write a 1-page incident response plan

CISA recommends that leaders write an incident response plan. Keep yours to a single page:

• Who to call first (your IT provider, your bank, your cyber insurer)
• How to disconnect an infected device from the network
• Where backups are and who can restore them
• Who to notify: law enforcement through the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov, and customers or regulators if personal data is involved
• Printed copies of key phone numbers, in case systems are down

Many states have breach notification laws with specific deadlines, so ask your attorney or insurer what applies to you. This is not legal advice.

After the first week: keep it going

Security isn’t a one-time project. Put these recurring tasks on your calendar:

• Monthly: check that updates and backups are running; review who has access to key accounts.
• Quarterly: test a restore; run a short phishing refresher with real examples.
• Yearly: review this checklist, your incident plan and your cyber insurance requirements.

When you’re ready to go further, consider endpoint detection and response, email security filtering and a managed IT provider. CISA also offers free services, including vulnerability scanning through its Cyber Hygiene Services. Our guide to ransomware protection explains the next layer of defenses.

Conclusion

You don’t need a security team to protect a small business. You need the basics done well and kept up: MFA, unique passwords, automatic updates, tested backups, encrypted devices, a locked-down network, trained staff and a plan for a bad day. Work through one day of this checklist at a time, and in a week your business will be meaningfully safer than it was. For definitions of any terms in this guide, visit our glossary.

Sources

• CISA: Secure Your Business — core practices for small and medium businesses, incident response planning
• CISA: Secure Our World, Use Strong Passwords — the 16-character guidance and password managers, part of the 4 essential steps
• CISA: Back Up Business Data — the 3-2-1 backup rule
• FTC: Cybersecurity for Small Business — password length, encryption of devices and data
• NIST: CSF 2.0 Small Business Quick Start Guide — the 6 framework functions for small businesses
• FBI Internet Crime Complaint Center — where to report cybercrime