Cybersecurity Basics for Small Businesses: A Prioritized Checklist
A prioritized security checklist built on free CISA, FTC and NIST guidance, ordered by what stops the most attacks for the least money.
Small business cybersecurity starts with 4 free basics from CISA: multi-factor authentication, strong unique passwords in a password manager, automatic software updates and phishing training. Add tested, offline backups and a 1-page incident plan. These steps block most common attacks and cost little beyond setup time.
Photo: Unsplash
On this page
- The priority checklist at a glance
- Priority 1: Turn on multi-factor authentication
- Priority 2: Fix passwords with a password manager
- Priority 3: Keep everything updated
- Priority 4: Train your team to spot phishing and payment fraud
- Priority 5 to 7: Backups, access and a plan for a bad day
- Free government resources worth bookmarking
- Where to start: a 30-day plan
- Conclusion
- Sources
Most small business owners know they should “do something” about cybersecurity. The problem is knowing what to do first. Security vendors pitch 20 products, and advice online ranges from “buy antivirus” to “hire a security team.”
The good news is that the US government already publishes clear, free guidance for small businesses, and it agrees on a short list of priorities. The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission (FTC) and the National Institute of Standards and Technology (NIST) all point to the same few habits.
This checklist puts those habits in priority order, so you can start with the steps that block the most attacks for the least money and work down from there.
Criminals don’t need to target you specifically. Many attacks are automated: phishing emails sent by the thousand, bots trying leaked passwords, scans for unpatched software. A small business with weak defenses is simply easier to get into.
The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of about $20.9 billion, a 26% increase over 2024. Business email compromise, where criminals hijack or imitate an email account to redirect payments, accounted for about $3 billion of that, second only to investment fraud.
Most of those losses trace back to basic gaps: a reused password, no MFA, a fake invoice nobody double-checked. That’s why the basics matter so much.
The priority checklist at a glance
| Priority | Action | Stops | Typical cost |
|---|---|---|---|
| 1 | Multi-factor authentication on email, banking, admin and remote access | Account takeover from stolen passwords | Usually included in services you already pay for |
| 2 | Password manager with strong, unique passwords | Credential stuffing and reused-password breaches | Low monthly per-user fee, some free options |
| 3 | Automatic updates and an inventory of devices and software | Attacks on known vulnerabilities | Mostly time |
| 4 | Phishing training and a “verify before you pay” rule | Business email compromise and malware | Free training resources available |
| 5 | Automated backups with an offline or immutable copy | Ransomware and data loss | Storage or backup service fees |
| 6 | Limit admin rights and remove ex-staff access fast | Insider misuse and spreading attacks | Time |
| 7 | 1-page incident response plan | Chaos and extra losses during an incident | Time |
The first 4 come straight from CISA’s “Four Cybersecurity Essentials for Businesses.” Backups and response planning come from CISA’s Cyber Essentials and NIST guidance.
Priority 1: Turn on multi-factor authentication
If you do only 1 thing this week, do this. MFA means a stolen password alone isn’t enough to log in.
CISA recommends turning on MFA for email, file storage, remote access, all admin accounts and anyone who handles sensitive data. It also ranks MFA methods from strongest to weakest:
- Physical security keys, which give the best protection against phishing.
- Authenticator apps with number matching, where you type a number from the login screen into the app.
- Authenticator apps with one-time codes.
Text message codes are better than nothing, but use stronger methods where you can, especially for email and banking. Our guide to setting up two-factor authentication covers the common services step by step.
Checklist: - [ ] MFA on every email account, starting with the owner and admins - [ ] MFA on business banking and payment accounts - [ ] MFA on your domain registrar, website builder and accounting software - [ ] MFA on any remote access or VPN
Priority 2: Fix passwords with a password manager
CISA’s guidance for businesses says passwords should be at least 16 characters, random (or a passphrase of 5 to 7 unrelated words) and used for only 1 account. Nobody can remember dozens of those, which is why CISA also recommends a company-wide password manager.
A business password manager lets each employee store strong, unique passwords, share team logins safely, and lose access instantly when they leave. See how to choose a business password manager.
Checklist: - [ ] Password manager rolled out to everyone - [ ] Default passwords changed on routers, cameras, printers and point-of-sale devices - [ ] Shared logins moved into the password manager instead of sticky notes or spreadsheets - [ ] Passkeys turned on where services support them
Key takeaway: MFA plus a password manager closes the door that most attackers walk through. Together they take an afternoon to set up and typically cost little or nothing beyond what you already pay for email and software.
Priority 3: Keep everything updated
Attackers routinely exploit software flaws that already have fixes available. CISA recommends turning on automatic updates wherever possible, prioritizing critical fixes on internet-facing systems, and keeping an inventory of authorized devices and apps.
Checklist: - [ ] Automatic updates on for computers, phones, browsers and apps - [ ] Router, firewall and Wi-Fi firmware updated (see how to secure business Wi-Fi) - [ ] A simple list of every device and key software tool, with who owns it - [ ] Unsupported systems identified and scheduled for replacement
If you still run an unsupported operating system, our guide to Windows 10 end of support explains your options.
Priority 4: Train your team to spot phishing and payment fraud
Phishing remains the most common way into a small business. CISA advises regular training rather than a once-a-year session, and says staff should verify suspicious messages through a known contact method, never by replying or using the phone number or link in the message.
The highest-value rule for most businesses: any request to change payment details or send money urgently gets verified by phone, using a number you already have. That 1 habit defeats most business email compromise attempts.
Checklist: - [ ] Short phishing training for all staff, repeated through the year - [ ] A written “verify before you pay” rule for payment changes and urgent transfers - [ ] An easy way to report suspicious emails, such as a shared address or a report button - [ ] No blame for people who report mistakes quickly
Our guides on how to spot phishing emails and security awareness training give you ready-to-use material.
Priority 5 to 7: Backups, access and a plan for a bad day
Back up, and keep a copy out of reach
CISA’s Cyber Essentials calls for regular automated backups of business-critical data and system configurations, with backups kept offline or otherwise protected. Ransomware often tries to encrypt or delete backups it can reach. Test a restore at least a few times a year. Our business data backup guide walks through the 3-2-1 approach.
Limit admin rights and clean up accounts
Daily work shouldn’t happen on an admin account. Give people the access their job needs, and remove accounts the day someone leaves. Our employee offboarding IT checklist helps.
Write a 1-page incident response plan
NIST’s Small Business Quick-Start Guide for its Cybersecurity Framework 2.0 advises having a basic incident response plan ready before anything happens. Keep it simple: who to call (your IT provider, bank, insurer), how to isolate affected devices, where the backups are, and how to report. Victims can report to the FBI at ic3.gov and to CISA. See how to create an incident response plan and, if the worst happens, what to do if your business is hacked.
Free government resources worth bookmarking
| Resource | From | What it gives you |
|---|---|---|
| Four Cybersecurity Essentials for Businesses | CISA | The core 4 steps with specific settings |
| Cyber Essentials and Starter Kit | CISA | A 6-part program covering leadership, staff, systems, surroundings, data and crisis response |
| Cyber Hygiene Services | CISA | Free vulnerability scanning of internet-facing systems for eligible organizations, including private critical infrastructure organizations |
| Cybersecurity for Small Business | FTC | Plain-language guides, videos and quizzes for staff training |
| CSF 2.0 Small Business Quick-Start Guide (SP 1300) | NIST | A starter plan organized around 6 functions: Govern, Identify, Protect, Detect, Respond and Recover |
Our overview of the NIST Cybersecurity Framework explains how those 6 functions fit together once you’re past the basics.
Where to start: a 30-day plan
Week 1: Turn on MFA for email, banking and admin accounts. Change default passwords on network devices.
Week 2: Roll out a password manager. Turn on automatic updates everywhere and write your device and software list.
Week 3: Run a short phishing training session and adopt the “verify before you pay” rule. Set up automated backups with an offline or immutable copy.
Week 4: Test a backup restore, review who has admin access, and write your 1-page incident plan. Put a quarterly review on the calendar.
If you’d rather hand some of this off, see how much cybersecurity costs for a small business and how to choose a managed IT service provider. For a day-by-day version of this plan, our 7-day cybersecurity checklist goes deeper on encryption and network settings.
Conclusion
Small business cybersecurity doesn’t start with expensive tools. It starts with MFA, strong unique passwords, automatic updates, trained staff, protected backups and a simple plan. CISA, the FTC and NIST give you all of it for free. Work through the checklist in order over the next 30 days, then review it every quarter. You’ll be a much harder target than most businesses your size.
Sources
- CISA: Four Cybersecurity Essentials for Businesses — MFA methods, password length, updates and phishing training
- CISA: Cyber Essentials — 6-element program including backups and crisis response
- CISA: Cyber Hygiene Services — free vulnerability scanning and eligibility
- FTC: Cybersecurity for Small Business — small business guides and training materials
- NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide — 6 functions and incident response planning
- FBI IC3: 2025 Internet Crime Report — 2025 complaint counts and losses, including business email compromise
Frequently asked questions
What is the most important cybersecurity step for a small business?
Turning on multi-factor authentication is the single most valuable step. It stops attackers from logging in with a stolen or guessed password, which is behind many account takeovers and email fraud cases. Start with email, banking, admin and remote access accounts. CISA recommends physical security keys or authenticator apps with number matching where available.
How much does cybersecurity cost for a small business?
The basics cost very little. MFA and automatic updates are usually included in services you already pay for, a business password manager typically has a low per-user monthly fee, and training resources from CISA and the FTC are free. Costs rise with managed IT services, advanced monitoring and cyber insurance. Start with the free and low-cost steps first.
Do small businesses really get hacked?
Yes. Many attacks are automated and opportunistic, so attackers hit whoever has weak defenses, regardless of size. The FBI's IC3 received more than 1 million complaints in 2025, with about $20.9 billion in reported losses. Small businesses often have valuable payment access and customer data but fewer protections, which makes basic defenses especially important.
What free cybersecurity resources are available for small businesses?
CISA offers its Four Cybersecurity Essentials for Businesses, the Cyber Essentials program and, for eligible organizations, free vulnerability scanning. The FTC publishes small business cybersecurity guides, videos and quizzes. NIST offers a Small Business Quick-Start Guide to its Cybersecurity Framework 2.0. All are free and written for non-specialists.
Is antivirus enough to protect a small business?
No. Antivirus or anti-malware is useful, and CISA recommends keeping it current, but it doesn't stop someone logging in with a stolen password or an employee paying a fake invoice. You also need MFA, a password manager, automatic updates, staff training and protected backups. Think of antivirus as 1 layer, not the whole plan.
How often should a small business train employees on cybersecurity?
Train new staff when they start, then reinforce it regularly throughout the year rather than in a single annual session, as CISA recommends. Short, frequent reminders about phishing and payment fraud work better than long courses. Many businesses add brief updates when new scams appear, such as AI voice cloning or fake invoice schemes.
What should I do first if my business gets hacked?
Disconnect affected devices from the network, but don't wipe them. Call your IT provider, bank and cyber insurer if you have one, and change passwords from a clean device with MFA turned on. If money was sent, contact your bank immediately to try to stop or recall the transfer, and report the incident to the FBI at ic3.gov.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com