Last verified October 16, 2026, against the CISA, FTC, NIST, IC3, and Microsoft pages linked below.
The day a small business calls me, the story is usually ordinary. A laptop walked out of a car. The bookkeeper paid a new account number. The person who knew the registrar login left in March. How bad that day is depends on a short list of dull jobs that were either done or skipped.
This is the list I work through at a business with somewhere between 3 and 50 people. You do not need a security team. Most of the items take minutes. A few take an afternoon. Where a government page says the thing plainly, I link it. Who publishes these notes is on the about page.
Print this page from your browser if you want a paper copy or a PDF. That printout is the downloadable version. I am not shipping a separate file of these 22 items.
Three free references I keep:
- CISA Cyber Essentials: CISA's guide for leaders of small businesses and of small and local government agencies.
- FTC Cybersecurity for Small Business: the FTC's small-business cybersecurity collection, including the lines on updates, backups, and routers.
- NIST Small Business Cybersecurity Corner: NIST's collection of small-business resources, for when this checklist is too short. The page is a list of other people's material. It is not a 20-step program of its own.
Accounts and access
Know who has admin rights, and cut the list. Pull every admin in Microsoft 365 or Google Workspace, the domain registrar, the website host, and the firewall. If a name on that list has left, or never needed admin, remove it today. Daily mail and browsing happen on a normal account. Admin is a second account you use when you mean to change something. CISA's Cyber Essentials says, "Grant access and admin permissions based on need-to-know and least privilege," and, "Leverage multi-factor authentication for all users, starting with privileged, administrative and remote access users."
Turn on multifactor authentication everywhere it is offered. Email first, then the bank, payroll, the registrar, and remote access. CISA's Cyber Essentials says, "Leverage multi-factor authentication for all users, starting with privileged, administrative and remote access users." If you are on Microsoft 365, Microsoft's security defaults documentation says, "Based on our learnings more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication." I wrote the click path for turning security defaults on. If the tenant misbehaves after you enable it, use Microsoft's documentation or Microsoft's own support.
Get a password manager for the business. A shared login in a spreadsheet is how one stolen password becomes five. A business password manager gives you a shared vault and a way to pull a leaver's access the same day. CISA's Cyber Essentials says, "Leverage unique passwords for all user accounts." The manager is how a 15-person office actually does that. The FTC's cybersecurity page says, "Never reuse passwords."
Have an offboarding checklist. When someone leaves: disable the account the same day, change shared passwords they knew, transfer the mailbox and files, and collect the laptop. Write the steps once. CISA's Cyber Essentials says, "Develop IT policies and procedures addressing changes in user status (transfers, termination, etc.)."
Know who owns your domain. Log into the registrar. The domain should be in the company's name, with a company address someone still reads, and auto-renew on. A lapsed domain takes email and the website down together. Getting one back from a former web designer is a week I would rather not spend.
Backups
Back up the things that matter, and know where they are. List accounting files, client records, the shared drive, and email. For each one, write where it lives and what copies it. "It is in the cloud" is availability, and a delete or a ransomware encrypt can sync to every logged-in machine. CISA's Stop Ransomware page says, "Maintain offline, encrypted backups of data and regularly test your backups." CISA's Cyber Essentials says, "Leverage protections for backups, including physical security, encryption and offline copies."
Keep at least one copy offline, and follow the 3-2-1 rule. If the backup share is mapped as a drive letter on the same PCs, ransomware can see it. Offline means the copy is not reachable from those PCs on an ordinary day: a disk you unplug, an immutable cloud copy, a backup account the workstations cannot log into. CISA's backup page names "the 3-2-1 backup rule": "3 copies of important files," "2 different types of storage media," and "1 copy stored off-site." CISA's Stop Ransomware page says, "Maintain offline, encrypted backups of data and regularly test your backups." The FTC's cybersecurity page says, "Regularly back up your data and make sure those backups are not connected to the network."
Test a restore. Pick one file and one folder and restore them. Time it. A backup you have never restored is a guess. Put a quarterly restore on the calendar, and send the success or failure mail to someone who still works there. If the backup product errors, use that vendor's support.
Back up Microsoft 365 or Google Workspace separately if losing a mailbox would stop the business. Retention and the recycle bin help, and they expire. Confirm the product you pick can restore a single message, not only a whole mailbox. I am not naming a winner. Read the vendor's own restore documentation.
Devices and patching
Keep an inventory. A simple list: every laptop, desktop, phone, printer, and network box, who has it, how old it is, and the OS. CISA's Cyber Essentials says, "Learn what is on your network. Maintain inventories of hardware and software assets." You cannot patch a machine you do not know you have. The warehouse laptop is the one that falls off this list.
Turn on automatic updates, and check that they are installing. The FTC's cybersecurity page says, "Set a schedule for updating programs, apps, web browsers, and operating systems. Turn on automatic updates." On a few Windows PCs, open Update history. Find the machine that has not installed anything in months. There is always one.
Retire unsupported operating systems, and check ESU before you call Windows 10 unpatched. A machine on an OS the vendor no longer patches stays exploitable. Microsoft's Windows 10 Home and Pro lifecycle page says, "Windows 10 will reach end of support on October 14, 2025," and that existing LTSC releases follow their own dates. That page shows support dates in the Pacific Time Zone, and the Home and Pro retirement timestamp in the table is 10/15/2025 6:59:59 AM. A Home or Pro PC still on Windows 10 is past that date unless it is enrolled in Extended Security Updates. Microsoft's consumer ESU page says eligible devices need to be running "Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition," and that enrolled coverage continues through October 12, 2027. That page says enrollment will not be offered for devices in kiosk mode, devices joined to an Active Directory domain or Microsoft Entra, or devices enrolled in MDM, and that "Microsoft Entra registered" devices can use the consumer program. Microsoft's commercial ESU page says, "Enrolled PCs belonging to a commercial or educational organization can receive security updates for a maximum of three years after end of support for Windows 10." Write down which program the PC is on, or that it is on neither. Check Microsoft's lifecycle search for the other versions you actually run. CISA's Cyber Essentials says, "Replace unsupported operating systems, applications and hardware."
Encrypt laptops. The FTC's cybersecurity page says, "Encrypt devices and other media that contain sensitive personal information. This includes laptops ..." Use the encryption your operating system's own documentation describes. Store the recovery key somewhere you can open when the laptop is gone. A key saved only on the laptop does not count. If encryption fails to turn on, use Microsoft's or Apple's own support.
Run endpoint protection, and look at it. What matters is that a person sees the alerts. An icon in the tray with a year of unread detections is not protection. Clearing a detection belongs in that vendor's console and that vendor's support.
Network and email
Change default passwords on network gear. Router, firewall, access points, printers, cameras. Update the firmware too. The FTC's cybersecurity page says, "Change any pre-set router passwords and the default name of your router. Keep the router's software up to date." Another line says, "After you set up a router, change the default username and password, turn off remote management, and log out of the administrator account." The consumer router someone bought for the back office rarely gets either. If the firmware update bricks the box, call the vendor.
Separate guest Wi-Fi. Visitors and personal phones go on a guest network that cannot see the file server or the printers. Write the guest password on the board. Keep the office password off it. The FTC's cybersecurity page says, "Password-protect your network," and, "Make sure your router offers WPA2 or WPA3 encryption, and that it's turned on."
Set up SPF, DKIM, and DMARC for your domain. These DNS records are how other mail servers decide whether a message really came from you. Microsoft's email authentication guide calls SPF, DKIM, and DMARC "a group of standards to identify and prevent the delivery of email messages from forged senders." It says, "Spoofed senders are commonly used in business email compromise (BEC), phishing, and other email attacks." Your mail host's docs are the click path. Microsoft's articles linked from that page are the example if you are on Microsoft 365. Check the DNS, and send a message to an outside mailbox to see the result. If authentication fails, use Microsoft's troubleshooting article linked from that guide, or your mail host's support.
Verify payment changes on a second channel. Any email that asks to change bank details, buy gift cards, or rush a wire gets a phone call to a number I already have. I do not use the phone number in the email. The FBI IC3 public service announcement Business Email Compromise: The $55 Billion Scam (alert I-091124-PSA, September 11, 2024) says, "Use secondary channels and/or two-factor authentication to verify requests for changes in account information." That PSA's table lists 305,033 domestic and international incidents and $55,499,915,582 in domestic and international exposed dollar loss. The page says those figures "were reported to the FBI IC3, law enforcement and derived from filings with financial institutions between October 2013 and December 2023." "Exposed dollar loss" is their term. Hand the page to whoever pays the bills.
The paperwork
Write a one-page "who to call" sheet. IT contact, internet provider and account number, phone vendor, registrar, cyber insurance carrier, bank fraud line. Print it. When the network is down you will not open the PDF. CISA's Cyber Essentials says, "Learn who to call for help (outside partners, vendors, government/industry responders, technical advisors and law enforcement)."
Read your cyber insurance application. Open the application and the policy. If either one says you have multi-factor authentication, offline backups, or endpoint protection, go check that you do. A claim is a bad week to discover the form and the tenant disagree.
Train people to spot phishing. The FTC's cybersecurity page says, "Train your staff," and to train employees "on a regular schedule." The phishing section says to "include tips for spotting the latest schemes in your regular training." Put that on the calendar. The same section says, "Companies like Microsoft and KnowBe4 have free phishing simulators online." If you use one, follow that company's own instructions.
Write the incident plan on one page. The FTC's cybersecurity page says, "Have an incident response plan." It says to develop a plan "for saving data, running the business, and notifying customers" if you have a breach. The one-page length is mine. On that page: who decides, who calls the bank and the insurer, and where the offline backup is. Print it next to the who-to-call sheet.
Questions for the IT provider
If you already pay someone, use the list as questions. You want a written answer, and you want to recognize the names.
- "Show me the last restore test." The last backup job is a different event from the last time a file was restored and opened.
- "Who has admin on our Microsoft 365 or Google tenant?" You should get a short list, and you should know every name.
- "Is multifactor authentication enforced, or only available?" Available means a person can skip it. Enforced means sign-in stops without it.
- "Which machines are behind on updates today?" A provider with an RMM can answer from the console.
- "If you disappeared tomorrow, how do we get into the registrar, the firewall, the tenant, the backup, and the password vault?" That handover should be a document.
Vague answers are information. So is "don't worry about it."
Patterns I keep finding
The owner is Global Administrator on the mailbox that reads invoices all day. That is the account a phish wants. Split it (item 1).
The backup failed in April. The alert went to a former employee's mailbox. Point backup mail at a shared address a current person reads (item 8).
The domain is in the old web designer's registrar account. It works until renewal (item 5).
One PC never updates. It is usually in the warehouse or at reception, and it is often the Windows 10 box from item 12.
How to use the list
Go through it once. Mark each item green (done), yellow (partly), or red (not done, or you do not know). Then clear the red items in accounts and backups first. Book an afternoon for the yellows. Put a reminder six months out and run the list again.
The "no idea" marks are the useful ones. They are the places you cannot defend.
Or have a pro check it. The Small Business IT Checkup page says the session covers email security, backups, Wi-Fi and the network, passwords and accounts, and device health, and that you get a written report. That page says, "The Small Business IT Checkup is $199."
Do the first pass this month. Start with who has admin and whether you can restore one file.
What the $199 checkup covers is on the site FAQ.
Works Cited
"About." ITOps Desk, itopsdesk.org/about. Accessed 16 Oct. 2026.
"Back Up Business Data." CISA, www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data. Accessed 16 Oct. 2026.
"Business Email Compromise: The $55 Billion Scam." Internet Crime Complaint Center, 11 Sept. 2024, www.ic3.gov/PSA/2024/PSA240911. Accessed 16 Oct. 2026.
"Cyber Essentials." CISA, www.cisa.gov/resources-tools/resources/cyber-essentials. Accessed 16 Oct. 2026.
"Cybersecurity for Small Business." Federal Trade Commission, Sept. 2025, www.ftc.gov/business-guidance/small-businesses/cybersecurity. Accessed 16 Oct. 2026.
"FAQ." ITOps Desk, itopsdesk.org/faq. Accessed 16 Oct. 2026.
Microsoft. "Configure Security Defaults for Microsoft Entra ID." Microsoft Learn, 16 Oct. 2026, learn.microsoft.com/en-us/entra/fundamentals/security-defaults. Accessed 16 Oct. 2026.
Microsoft. "Extended Security Updates (ESU) program for Windows 10." Microsoft Learn, 17 Nov. 2025, learn.microsoft.com/en-us/windows/whats-new/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "How email authentication works in Microsoft 365." Microsoft Learn, 3 July 2026, learn.microsoft.com/en-us/defender-office-365/email-authentication-about. Accessed 16 Oct. 2026.
Microsoft. "Microsoft Lifecycle Policy." Microsoft Learn, learn.microsoft.com/en-us/lifecycle/. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Consumer Extended Security Updates (ESU)." Microsoft Windows, www.microsoft.com/en-us/windows/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Home and Pro." Microsoft Learn, learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro. Accessed 16 Oct. 2026.
NIST. "Small Business Cybersecurity Corner." NIST, www.nist.gov/itl/smallbusinesscyber. Accessed 16 Oct. 2026.
"Small Business IT Checkup." ITOps Desk, itopsdesk.org/small-business-it-checkup. Accessed 16 Oct. 2026.
"Stop Ransomware." CISA, www.cisa.gov/stopransomware. Accessed 16 Oct. 2026.