Cybersecurity Basics for Small Business: A 2026 Checklist

Most small businesses are not breached by a patient, highly skilled attacker. They are caught by a reused password, a laptop that missed two years of updates, an invoice reply that looked real, or a backup that had never been restored. The damage is rarely dramatic; it is a week of lost work, a fraudulent payment and a customer list that has to be explained to clients.

Start with accounts

Accounts are the front door. Use a password manager for every person, unique passwords for every service, and multi-factor authentication on email, banking, cloud and admin panels. Email is the priority: if an attacker controls the inbox, they can reset almost everything else.

Remove accounts that nobody uses. A departed employee's login is a permanent risk, and shared logins make it impossible to know who did what. Give each person their own account, grant the minimum access they need and review the list every quarter.

Security is not a project with an end date. It is a short list of habits that survive a busy month.

Patch, back up and test

Turn on automatic updates for operating systems, browsers and the software that touches money or customer data. A patch that sits uninstalled for months is the most common open door. For devices that cannot update automatically, put a monthly reminder in the calendar and assign an owner.

Backups are only real when they have been restored. Keep three copies, on two media, with one off-site, and test a restore at least once a quarter. Ransomware is designed to find connected backups, so keep at least one copy offline or immutable.

The checklist

Work through this list in order. The early items are cheap and stop the most common attacks; the later items improve detection and recovery. Do not wait for a perfect score before doing the first five.

Password manager for every team member. Multi-factor authentication on email, banking and admin accounts. Automatic updates on all devices and plugins. Three copies of data, one offline or immutable, with a tested restore. Separate accounts for work and personal use. A phishing reporting process and a named person to call. Device encryption and screen locks. Written incident steps: who to call, what to disconnect, where to report.

People, email and devices

Train people on the two attacks they will actually see: a message that creates urgency and a login page that is not the real one. Keep the training short and repeat it. A five-minute example in a team meeting beats an hour-long annual module nobody remembers.

Add a payment verification rule: any change to bank details is confirmed by a phone call to a known number, never by replying to the email that requested it. Invoice fraud is boring, common and expensive, and a single rule prevents most of it.

When something goes wrong

Write the first hour down before you need it: disconnect the affected device, change the passwords from a clean device, tell the named person, preserve logs and contact your bank if money moved. Do not wipe evidence in a panic, and do not pay a ransom without advice. Speed matters, but so does a clear head.

For the login change that removes passwords from the equation, read our passkeys guide. For the engineering side, see our code review practices.