A practical cyber security checklist for small businesses

Start with what would stop the business working

Write down the services you depend on: email, bookings, invoicing, shared files and any specialist software. Note who manages each service and who to contact if access is lost. A list of products alone will not tell you whether the business can recover.

• Which systems and information would you need first after an interruption?
• Who owns the administrator accounts, including systems managed by suppliers?
• Is there a secure way to find essential contact details if email is unavailable?

1. Check email and account access

Ask whether multi-factor authentication is required for business email and other important accounts, especially administrators. Check how access is removed when someone leaves and how recovery works if a phone is lost. Keep passwords and recovery codes out of the checklist itself.

• Does each person have their own account?
• Are shared access and administrator permissions still needed?
• Who reviews account access when roles or suppliers change?

2. Know which devices you rely on

Include laptops, desktops and phones used for work. Ask the person responsible for IT to identify unsupported systems, outstanding updates and gaps in device protection. Agree how lost equipment is reported and what happens to business information when a device is replaced.

3. Check that recovery is practical

A backup should help you recover the information the business needs. Ask what is covered, when a restore was last tested and where the result was recorded. File synchronisation can copy unwanted changes too; confirm what separate recovery options you actually have.

• Who can authorise and carry out a restore?
• Would backups still be available if a normal business account was compromised?
• How much work could be lost, and how long could the business manage without the system?

4. Make suspicious requests easy to challenge

Agree how staff should report an unexpected login prompt, an unusual attachment or a request to change payment details. For payment changes, use a known contact route to confirm the request rather than relying on details supplied in the message. Practise the conversation without blaming anyone for asking for help.

5. Turn unknowns into a short action list

Give each open question an owner and a review date. Separate an immediate concern from a longer-term improvement, and ask for evidence before marking an item complete. For example, a written record of a successful restore is more useful than an assumption that backups probably work.

If several answers are unclear, a Security Health Check can help establish a baseline and organise the next steps. Sanderson reviews the agreed scope, explains findings in plain English and provides a prioritised remediation roadmap. Implementation and follow-up are agreed separately.