# Small Business Cybersecurity Checklist: 10 Steps to Finish This Month

Source: https://steadyhandit.com/journal/small-business-cybersecurity-checklist/

[Home](https://steadyhandit.com/) / [Journal](https://steadyhandit.com/journal/) / Cybersecurity checklist

# A small business cybersecurity checklist you can finish this month

Short answer: Ten practical steps for small businesses: password manager, MFA, backups, updates, email protection, access control and an incident plan, in order of payoff.

    Published 2026-11-02

    Most small-business incidents start with a stolen password, a phishing email, a missed update or a missing backup. Ten steps close those doors: password manager, two-step sign-in, tested backups, automatic updates, email protection, access cleanup, device encryption, a team briefing, an AI rule, and a written incident plan.

    Industry reports such as Verizon's annual [Data Breach Investigations Report](https://verizon.com/about/news/2025-data-breach-investigations-report) consistently show ransomware and stolen credentials among the leading causes, and show smaller organizations affected disproportionately. Check the primary report for current figures.

- Use a password manager for every shared and personal business login.

- Turn on two-step sign-in (MFA) for email first, then banking, cloud storage and accounting. Prefer an authenticator app over text messages.

- Back up automatically to somewhere off the computer, keep versions, and test a restore.

- Enable automatic updates on computers, phones and the router. Replace devices that no longer get updates.

- Protect email: use the built-in spam and phishing filters, and set up SPF, DKIM and DMARC for your domain.

- Clean up access: list who has admin rights, remove former staff the same day, stop sharing logins.

- Encrypt laptops and phones and know how to wipe a lost one.

- Brief your team for 20 minutes on phishing and who to tell after a wrong click.

- Write an AI rule: no customer data or secrets in free consumer AI tools. See [the one-page policy](https://steadyhandit.com/journal/ai-policy-for-small-business/).

- Write a one-page incident plan: who to call, what to disconnect, where backups live, and who to notify.

## A note on the law

    North Carolina's Identity Theft Protection Act requires businesses that hold residents' personal information to notify affected people after a security breach, and vendors holding data for others must notify the data owner. Read the details on the [NC Attorney General's page](https://ncdoj.gov/?p=530). This is general information, not legal advice.

### Want help with these?
The $495 Security Checkup covers most of this list and gives you a ranked fix list.
[See the Security Checkup](https://steadyhandit.com/security-basics/)