Most small business losses start with an inbox, not a hacker in a hoodie
You don't need a security team to get most of the protection. You need a short list, done in the right order. This checklist follows the priorities in CISA's guidance for small businesses and the FBI's data on what actually costs companies money.
Accounts first, because email is how most fraud starts and how most other passwords get reset. Money next, because a simple payment rule costs nothing and protects against the biggest loss category. Devices and recovery after that, because they limit the damage when something does get through.
This week: the Top 10
If you only do one page, do this one. Most of these take minutes and cost nothing.
- ///Turn on MFA for every account, starting with email
Email is the key to everything else because it resets other passwords. CISA recommends MFA on every account that supports it.
- ///Use phishing-resistant MFA for admins and finance
Passkeys or security keys. CISA calls FIDO the only widely available phishing-resistant method. If you can't yet, use an authenticator app with number matching, not text messages.
- ///Separate admin accounts from everyday accounts
Don't read email from an admin account. Keep global admins to two or three people.
- ///Use a company password manager
Unique, long passwords everywhere. No shared spreadsheets, no reused passwords.
- ///Set a call-back rule for payment changes
Any new or changed bank details get verified by calling a number you already have on file, never one from the email. This one rule defeats the classic invoice scam.
- ///Turn on automatic updates everywhere
Windows, macOS, phones, browsers, and business apps. Replace anything no longer supported.
- ///Encrypt every laptop and require a screen lock
BitLocker on Windows, FileVault on Mac. A stolen encrypted laptop is a hardware loss, not a data breach.
- ///Block automatic email forwarding outside the company
Attackers quietly set rules that copy your mail to themselves.
- ///Confirm your backups work by restoring a file
Your cloud apps aren't a backup. A backup you haven't restored is only a hope.
- ///Write down who to call
Your bank's fraud line, your IT provider, your insurer, IC3.gov, and CISA at 1-844-729-2472. Keep it on paper too, since email may be down.
Most small business attacks aren't clever. We look for a reused password with no MFA, then watch the inbox for an invoice. Everything on this list breaks that plan.
What's in the full PDF
- ///The setup map: exactly where each setting lives in Microsoft 365 and Google Workspace
- ///Month 1 lists for accounts, devices, the physical workspace, and remote work
- ///The quarterly maintenance list, ready for your calendar
- ///A fillable scorecard to track your progress each quarter