A small business cybersecurity checklist is not a shopping list. It is an order of operations.
Seven things protect most of what matters in a thirty to sixty person company, and doing them in the wrong order wastes money on the ones that were never going to be your problem.
Why this checklist starts with money rather than tools
Everything below exists to stop one of three things: a payment leaving for the wrong account, your files becoming unreadable on a Monday morning, or a customer learning about a problem before you do. When you evaluate a security proposal, the honest test is which of those three it prevents, and how quickly you would find out if it failed.
Nothing here requires you to open a console or understand a protocol. Each item is something you should be able to confirm exists, in one sentence, without asking anybody to explain it twice.
The seven items, in the order to build them
- Five accounts that never share a password
Five accounts carry almost all of your risk: your email, your bank and payroll, your accounting system, whoever holds your domain name, and the place your passwords are stored. Each of those needs a password used nowhere else on earth.
- A code on the phone for everyone who signs in
Set it up so that signing in also needs a code on a phone, or a tap in an app, for every person and every account. This single step blocks the majority of stolen password attacks, because the password on its own stops being enough.
- Updates that install without anyone remembering
Somebody has to be responsible for making sure computers, phones and business software update automatically, and for confirming once a month that they actually did. Left to individual employees, this never happens, because the update always arrives at a bad moment.
- A backup somebody has actually restored
An untested backup is a belief, not a protection. At least once a year, somebody should restore real files from it and time how long that took. The number you want written down is how many hours it takes to get your business working again, not how many copies exist.
- One written rule about changing bank details
Any request to change payment details, from anyone, gets verified by calling a number you already had on file, never a number in the message. Put that sentence on one page, sign it, and give it to whoever pays your invoices. It costs nothing and it stops the most expensive fraud on this list.
- A list of who can reach what
Once every six months, look at who still has access to your systems and remove the people who left, the contractors who finished, and the shared logins nobody remembers creating. Departures are the moment this list goes wrong.
- A name and a number for the bad day
Decide now who you call at 7 a.m. on a Sunday, and confirm that they answer. Add your bank fraud line and your insurer incident number to the same page.
The figure that sets the order
The Verizon 2026 breach report changed the ranking of how attackers get in. Exploiting unpatched software passed stolen passwords for the first time and now accounts for 31% of confirmed breaches. Ransomware appeared in 48% of the breaches analyzed. That is why updates sit high on this list and backups sit right after them.
The reversal matters for a practical reason. For years the advice to small companies was that passwords were the whole game. Passwords still are a large part of it, which is why they open this list, but a company that fixed only its passwords in 2024 is now exposed on the vector that overtook them.
What this actually costs to put in place
Most owners expect this list to arrive with a large invoice attached, and that expectation is what delays it by a year. In practice, four of the seven items cost nothing beyond somebody deciding to do them. The password rule, the written payment rule, the access review and the phone number on the wall are decisions rather than purchases.
The code at sign-in is almost always included in the business email subscription you already pay for, switched off until somebody turns it on. Automatic updates are a setting. That leaves backups, which usually do carry a real monthly cost, and the person who answers on Sunday, which is what you are buying when you retain a provider.
So the useful budget question is narrower than it looks. Ask what the backup costs per month and what the response commitment costs per month, then treat everything else as time rather than spend. When a proposal prices all seven items as one bundle, ask for those two lines separately, because they are the only ones where more money buys more protection.
What changes if your company is in Georgia
Two things make this list less optional for businesses around Augusta and the wider CSRA. The first is the customer base. A large share of local companies sell into the defense supply chain, and those customers increasingly ask their smaller suppliers to document exactly the basics above before renewing a contract.
The second is insurance. Renewal questionnaires now ask directly whether you have a code at sign-in and tested backups, and answering loosely on a form is a problem you discover during a claim. If either of those applies to you, the checklist stops being an internal hygiene exercise and becomes something you may have to prove to somebody else.
The questions to ask your IT provider
- Which of these seven items do we already have, and which do we not?
- When did somebody last restore a real file from our backup, and how long did it take?
- Which accounts in this company can still be opened with a password alone?
- How do we find out that our computers did not update, and who looks?
- Who answers the phone on a Sunday morning, and what is the number?
An honest provider will tell you which items are missing without turning it into a proposal in the same breath. If yours cannot produce that list, that is the finding.
| Alchanis Technical Services works with small and mid-size businesses across Augusta, Columbia County and Georgia as their outsourced IT and security team.
If you want the seven items checked against your actual setup, start at alchanistech.com. |
