Cybersecurity & Cloud
Cybersecurity Checklist for Small Businesses
Skip the enterprise theater. MFA, unique passwords, backups you’ve actually restored, and fewer admins - the boring stuff that stops most SMB incidents.
Part of the Business Cybersecurity Basics series.
Most small businesses don’t need a SOC theater production. They need habits that block the boring, common failures: reused passwords, unpatched plugins, backups nobody tested, and six people sharing the CMS admin login.
Identity and access
- Unique passwords in a manager. Generate strong ones with Password Generator.
- MFA on email, banking, cloud admin, and the CMS.
- Fewer admins. Separate personal and work accounts.
Website and app hygiene
- Update the CMS and plugins. Remove abandoned extensions.
- HTTPS everywhere. Consider a starter CSP with CSP Builder.
- Offsite backups you’ve actually restored once - a backup you’ve never tested is a hope, not a plan.
People still click
Phishing wins because it looks urgent. Verify payment-change requests out-of-band. And don’t paste production secrets into random “free online tools.”
FAQ
Is antivirus enough?
No. It’s one layer. For a lot of SMB incidents, backups, MFA, patching, and access control do more of the heavy lifting.