Free download
Small Business Cybersecurity Checklist
Eleven practical controls for teams of roughly 5–100 people. Print it, tick each box, and revisit it every quarter. No email signup is required to download it.
Get the Small Business Cyber Checklist
The PDF download on this page is immediate, with no signup needed. If you would also like the checklist by email and occasional updates when new guides are published, leave your email below and check your inbox to confirm your subscription if Kit asks you to.
Turn on MFA everywhere
Email, banking, payroll, cloud admin and remote access first. Prefer authenticator apps or passkeys over SMS codes.
Use a team password manager
Unique passwords for every account, shared vaults instead of spreadsheets, and an offboarding plan for departing staff.
Back up and test restores
Follow 3-2-1: three copies, two media types, one offsite or immutable. Test a restore at least quarterly. Cloud sync is not a backup.
Keep everything updated
Turn on automatic updates for operating systems, browsers and apps. Replace devices that no longer get security patches.
Lock down email: SPF, DKIM, DMARC
Publish SPF and DKIM for every service that sends mail as you, then move DMARC from p=none toward quarantine or reject.
Train for phishing and quishing
Teach staff to verify payment or password requests by phone, and to treat QR codes in emails, flyers and parking signs as links.
Secure remote access with a business VPN
Avoid exposing RDP or admin panels to the internet. Use a business VPN or zero-trust access with MFA for remote staff.
Protect every endpoint
Run managed endpoint protection (EDR where possible), enable disk encryption, and keep a list of every company laptop and phone.
Offboard the same day
Disable email and cloud accounts, remove the person from the password vault, rotate shared logins, and collect devices when someone leaves.
Verify payments by callback
For wire, ACH, or bank-detail changes, call a known number from your records - never the number in the email - before paying.
Encrypt every laptop disk
Turn on BitLocker (Windows) or FileVault (Mac), store recovery keys in your password manager, and verify encryption on every company laptop.
Ready to go beyond the checklist? The Small Business Security Essentials Toolkit ($79) turns these controls into a working program: a scored self-assessment that ranks what to fix first, 10 editable policies, 10 spreadsheets, and 5 incident playbooks.