Most successful attacks on small businesses do not rely on anything sophisticated. They rely on a password that was reused, an account without multi-factor authentication, a laptop that missed months of updates, or a backup that turned out not to exist. A baseline is the set of controls that closes those doors consistently.

This checklist is deliberately short. It is not a compliance framework and it will not make you immune to attack. It is the minimum we believe every small and midsize business should be able to say “yes” to.

Identity and access

  • Multi-factor authentication (MFA) on every account that supports it. Email, Microsoft 365 or Google Workspace, remote access, banking, payroll and any cloud application with client data. No exceptions for executives.
  • One person, one account. No shared logins for front desks, scanners or "admin". Shared accounts make it impossible to know who did what, or to remove one person's access.
  • Admin rights only where needed. Day-to-day accounts should not be administrators. Administrative access should be separate and protected with stronger controls.
  • Access removed the day someone leaves. A written offboarding process that disables sign-in, revokes sessions and recovers devices.

Devices

  • Every computer is managed. You know how many devices you have, who uses them and whether they are healthy.
  • Updates are applied on a schedule. Operating systems and common applications are patched automatically, and failures are noticed.
  • Endpoint protection with detection and response. Modern protection that can spot and contain suspicious behaviour, not only known viruses.
  • Disk encryption on laptops. A lost laptop should be an equipment cost, not a data breach.

Email and web

  • Email filtering for phishing and impersonation. Plus the domain settings (SPF, DKIM and DMARC) that make your own domain harder to spoof.
  • DNS or web filtering. Blocks connections to known-malicious sites, including from links people click by mistake.

Data and recovery

  • Backups you control, kept separate from the systems they protect. Including Microsoft 365 or Google Workspace data, not only servers and laptops.
  • A restore has been tested recently. If no one has restored a file or system in the last few months, you do not yet know that your backups work.

People

Technology cannot do all of the work. Short, regular security awareness training and occasional phishing simulations help staff recognise suspicious messages and, more importantly, report them quickly without fear of blame.

Where to start if you cannot tick every box

Prioritise in this order: MFA everywhere, tested backups, managed and updated devices, then everything else. Those three address the most common causes of serious incidents for small businesses.

If you would like an outside view of where you stand, the ZARS IT Assessment reviews these controls in your environment. Security controls like these are part of how ZARS Managed IT Services are run, and are explained in more depth on our Cybersecurity page.