Guide · Getting started

The 1-hour security check every small business should do

By Christopher Smith, MS Cyber Security, penetration tester·Published ·Updated ·7 min read

Most small businesses don’t start on security because it looks like a big project. It doesn’t have to start that way. In one hour, with nothing to buy, you can fix the gaps that hurt small offices most often: nobody knows who to call when something goes wrong, money moves on the strength of an email, and MFA on email is “available” but not actually required.

This guide is the companion to our Short on the 1-hour security check. It walks through four checks in 15-minute blocks, with the reason behind each one. You need a printer, a phone, and whoever can see your email admin settings.

The four checks at a glance

TimeCheckYou finish with
0–15 minWrite down who to call: IT contact, bank fraud line, insurer. Print it.A paper contact card that still works when email and files don’t
15–30 minNo payment or bank-detail change without a call to a number you already haveA written rule your staff has seen, and the real numbers for your top vendors
30–45 minCheck that MFA on email is required for everyone, not just availableA yes/no answer you can act on (and that insurers commonly ask for)
45–60 minList your top five gaps, each with an owner and a dateA short, dated to-do list instead of a vague worry

The rule for the hour: look and write things down. Don’t change settings yet. Changing MFA or admin settings in a hurry is how people get locked out of their own email. The fixes come after, in the order your list says.

0–15 min: write down who to call. Print it.

When something goes wrong, such as a ransomware screen, a hijacked mailbox, or a wire that went to the wrong account, the first problem is usually not technical. It’s that nobody knows who to call, and the numbers are in the email account or the file share that just stopped working. Fill in these contacts on one page:

  1. Who runs the response, plus a backup. One person decides how serious it is and makes the calls. In a small office that is usually the owner or the office manager.
  2. Your IT contact or managed IT provider. Write down the after-hours or emergency number, not the general support inbox.
  3. Your bank’s fraud line. Take it from the back of the business debit card or a bank statement. Never take it from an email.
  4. Your cyber insurance claims line and policy number, if you have a policy. They are on the declarations page, or your broker can send them. Many policies expect you to report an incident promptly, and some want you to use their approved response firms.

Print a copy for every desk and save a photo on the owner’s phone. Paper sounds old-fashioned, but it is the one copy an attacker can’t encrypt or lock you out of.

Why it matters: money sent by wire can sometimes be recovered when the bank is told fast. The FBI’s IC3 asks victims to contact their bank right away and file a report. Ten minutes spent hunting for the right number can be the difference.

15–30 min: no payment change without a call-back

The costliest scam most small businesses face is not a hacker breaking in. It’s an email that looks like it’s from a vendor, a client, or the owner, asking to pay a new account “starting with this invoice.” Our fake wire request (BEC) guide covers how those emails work. The defense is one rule, written down:

Payment rule: Any request to pay a new account, change bank details, change a payroll deposit, or buy gift cards gets a phone call to the number we already have on file before anything is paid, and a second person approves it. That includes requests that look like they come from the owner. Never use a phone number, link, or reply address from the request itself.

  1. Send the rule to staff today. Short and in writing beats a policy nobody reads. Add a line asking people to report mistakes fast, like clicking a link or approving a sign-in prompt they didn’t start, and make it clear nobody gets in trouble for reporting quickly.
  2. Write down the real numbers for your three most-paid vendors, taken from a contract, an old genuine invoice, or their website. That is the “number you already have.” If you only look it up when the urgent email arrives, you are more likely to use the number in the email.
  3. Name the second approver. In a two-person office that might be the owner and the bookkeeper. What matters is that one person can’t move money alone on the strength of an email.

Why it matters: these scams beat spam filters because the email often contains nothing malicious, just words. Only a habit stops them, and a habit starts with a written rule.

30–45 min: check that MFA on email is required

Your email account is the reset key for almost everything else: banking, payroll, your domain, your cloud files. Multi-factor authentication (MFA) is the single best protection for it. CISA recommends it for every account that offers it. The common gap is that MFA is available and a few people turned it on, but it is not required, so the accounts that matter most may not have it.

Record one answer: Required, Available only, or Not set up. If it is not required, don’t flip the switch for everyone in the middle of a workday. Turn it on for one person first, make sure their recovery options work, then roll it out. Our MFA for Microsoft 365 guide has a safe rollout order.

Why it matters: stolen and reused passwords are how most mailbox takeovers start, and MFA stops most of them. Cyber insurance applications also commonly ask whether MFA is enforced on email, so it helps to know the true answer before you fill one in.

45–60 min: list your top five gaps

Use the last 15 minutes to turn “we should probably do more” into a short list. Go through our free Small Business Cybersecurity Checklist and mark every “no” or “not sure.” Then pick the five that would hurt most if they went wrong. For most small offices they come from this list:

Give each of the five one owner (a person’s name, not “IT”) and one date (a real date, not “soon”). A list without names and dates is a wish list. A list with them is a plan you can check on next month.

After the hour

These four wins are also Quick Start: Your First Hour in the Security Essentials Toolkit, with a printable card and the Self-Assessment that ranks what to do next.

You now have a printed contact card, a payment rule your staff has seen, a true answer about MFA on email, and five dated fixes with owners. That is more than many small businesses have on paper. Next:

  1. Fix MFA first if your answer was anything other than “Required.” It protects the most for the least effort.
  2. Work the list in order, one item a week. Each item above links to a guide with the steps.
  3. Put a repeat on the calendar. Redo this check every three months, or right away after someone leaves, you change IT providers, or your insurance renews.

Want the templates for all four checks?

The Small Business Security Essentials Toolkit ($79) turns this hour into fill-in files: a First 60 Minutes contacts card, a payment verification log, an MFA coverage tracker, and a 32-question Self-Assessment that scores you and ranks your gaps. It also includes 10 editable policies and a 13-week roadmap for what comes next. Everything in this guide works without it.

See what’s in the toolkit →

Bottom line

You don’t need a security department to start. You need one hour: who to call, a call-back rule for money, a true answer about MFA on email, and five fixes with names and dates. Do it this week, then do it again in three months.

Prefer video? Watch the under-a-minute version on YouTube: The 1-Hour Security Check Every Small Business Should Do.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.

This check is Hour 1 of the toolkit. The Small Business Security Essentials Toolkit ($79) includes Quick Start: Your First Hour (the same four wins), a 32-question Security Self-Assessment that builds your priority list, and a 30/60/90-day rollout workbook.