Small Business Cybersecurity Checklist for 2026

Small businesses are not too small to attract attackers. They often hold valuable customer data, payment access and supplier relationships while operating with fewer dedicated security resources.

The 2026 Verizon Data Breach Investigations Report highlights vulnerabilities, ransomware, third-party exposure and AI-assisted attack techniques as continuing risks. The right response is not buying every security product. It is making a short list of high-impact controls routine.

1. Require phishing-resistant multi-factor authentication

Passwords alone are not enough for email, cloud administration, finance, CRM or source-code accounts. Require MFA for every privileged or sensitive system.

The US Cybersecurity and Infrastructure Security Agency recommends MFA and advises organisations to prefer phishing-resistant methods, such as security keys, where possible.

Start with administrators and email, then cover every user.

2. Use a password manager and remove shared logins

Every service should have a unique password. Shared credentials hide who performed an action and become difficult to revoke when somebody leaves.

Use named accounts, role-based access and a business password manager for the limited secrets that genuinely must be shared.

3. Patch internet-facing systems quickly

Websites, VPNs, routers, plugins and remote-access tools are exposed to the public internet. Maintain an inventory, enable supported automatic updates and define an urgent patch process for actively exploited vulnerabilities.

If a system is no longer supported, replacement is a security project, not an optional upgrade.

4. Back up data, then prove recovery works

Keep backups separate from the systems they protect. Use more than one copy and prevent everyday user accounts from deleting every backup.

Test a real restore. A dashboard saying "backup successful" does not prove that the business can recover customer records, files and configuration within an acceptable time.

5. Protect email and payment changes

Business email compromise often targets normal processes: a supplier's bank details change, a director requests an urgent transfer or a customer sends a new payment instruction.

Require a second verification channel for financial changes. Call a known number rather than the contact details in the suspicious message.

6. Give people the minimum access they need

Administrator access should be rare and separate from everyday work. Review permissions quarterly and remove dormant accounts promptly.

For web applications, role design must also be enforced on the server. Hiding a button is not authorisation. Our Cybersecurity & Performance reviews examine authentication, permissions, dependency risk and exposed data as one system.

7. Secure devices and remote work

Require screen locks, disk encryption, supported operating systems and managed updates. Create a clear process for lost devices.

Personal devices that access company data need minimum standards or a controlled browser and application policy. Convenience should not create an unmanaged copy of sensitive information.

8. Monitor important events

Centralise logs for sign-ins, administrator changes, failed access, deployments and critical business actions. Set alerts for behaviour that needs investigation, but avoid thousands of low-value notifications that nobody reads.

Reliable infrastructure, automated deployment and monitoring are core parts of our Cloud & DevOps work because operational visibility is part of security.

9. Review suppliers and connected apps

Every integration, contractor and software supplier expands the security boundary. Keep a register of systems with access to customer or financial data.

Ask what data is stored, where it is stored, how access is revoked, how incidents are reported and whether the integration still serves a business purpose.

The CISA small and medium business resources provide a useful baseline for phishing, passwords, updates and recovery.

10. Write a one-page incident plan

Decide who leads, who can take systems offline, who contacts customers and suppliers, where clean backups are stored and which external specialists to call.

Keep an offline copy. During ransomware, account compromise or a provider outage, the normal communication tools may not be trustworthy.

A 30-day order of work

Week one: enable MFA on email, finance, cloud and administrator accounts.

Week two: inventory devices, software, domains, backups and third-party access.

Week three: patch critical exposure, remove dormant accounts and test recovery.

Week four: establish alerts, supplier review and the incident contact sheet.

Cybersecurity improves through repeatable ownership, not a one-time audit. Review the checklist every quarter and after any significant system change.

If you need an evidence-based view of your current exposure, request a security and performance review. We will prioritise the practical fixes that reduce risk fastest and separate urgent work from longer-term improvement.