Skip to main content

The 10-Point Small Business Security Checklist

The ten highest-impact security fixes for a small business, in priority order. Most take under an hour; together they close the gaps behind the large majority of small-business incidents.

Free resourcePriority orderNo signup required

Work down the list

Print it, work through it, done. The order matters — start at one and keep going.

  1. Turn on multi-factor authentication (MFA) everywhere

    Start with email, banking, and anything that can spend money or reset other passwords. An authenticator app beats SMS codes.

  2. Adopt a password manager

    One strong master password; unique generated passwords for everything else. Stop the reuse chain that turns one leak into five.

  3. Set up automatic, tested backups

    Automate backups of everything you can't afford to lose, keep at least one copy offsite or offline, and actually restore a file once a quarter to prove it works.

  4. Let updates install themselves

    Enable automatic updates on operating systems, browsers, and key apps. Postponed updates are open doors that were already fixed.

  5. Encrypt and lock every work device

    Full-disk encryption (BitLocker/FileVault), a strong lock screen, and remote-wipe capability on laptops and phones that touch work data.

  6. Verify payment changes by phone

    Any request to change banking details — from a supplier, client, or executive — gets confirmed by phone using a number you already had. No exceptions.

  7. Kill shared logins

    Give every person their own account with only the access their role needs. Shared credentials make incidents impossible to trace and revoke.

  8. Write the one-page security policy

    Passwords, devices, data handling, and who to call when something looks wrong. One page beats zero pages — and new hires need it most.

  9. Offboard with a checklist

    When someone leaves: accounts disabled same day, devices returned, shared passwords rotated. Keep the list written so nothing lingers.

  10. Talk about phishing openly

    Show your team (or yourself) real examples. Agree on one habit: unexpected requests for money, credentials, or urgency get verified through a second channel.

Want a second pair of eyes?

If you'd rather have someone walk through your setup with you, we do free, no-pressure consultations for small businesses across Ontario.

Book a free consultation