The 7-Step Small Business Security Checklist
Last updated: October 27, 2026
We may earn a commission if you buy through links here — it never changes our picks.
Most small business break-ins aren't sophisticated hacks — they're a reused password, a missed update, or one convincing fake email. These seven steps close the doors attackers actually walk through. Steps 1 and 2 are free and matter most; do them first.
Use a password manager — and a unique password for every account
Why it matters: When any website you've ever used gets breached, those passwords get tried against your email and bank automatically. Unique passwords mean one breach stays one breach instead of becoming every account you own. Tool that solves it: a password manager — it remembers a different strong password for every login so you only remember one. See our beginner's password manager guide for the picks.
Turn on MFA or passkeys everywhere
Why it matters: Multi-factor authentication means a stolen password alone isn't enough to get in — an attacker also needs your phone or security key. Passkeys are the newer, simpler version of the same idea, and they're harder to phish than codes. Tool that solves it: the built-in MFA/passkey settings in your email, banking, and social accounts, plus an authenticator app.
Use a VPN on public Wi-Fi
Why it matters: Café, hotel, and airport Wi-Fi is shared with strangers, and anything you send unprotected can potentially be seen on that network. A VPN encrypts your connection end to end, so the network itself can't read your traffic. Tool that solves it: a reputable VPN app — see our beginner's VPN guide for what to look for.
Turn on automatic updates
Why it matters: Most updates aren't new features — they're patches for security holes that attackers start exploiting within days of the fix being published. Running old software is leaving a known-open window unlocked. Tool that solves it: the automatic update setting on every phone, computer, browser, and router — set it once, forget it.
Back up with the 3-2-1 rule
Why it matters: Ransomware, theft, and a failed hard drive can all take your files in an afternoon — but none of them can touch a good backup. The 3-2-1 rule in plain words: keep 3 copies of important files, on 2 different kinds of storage (say, your computer and an external drive), with 1 copy kept somewhere else entirely (cloud backup counts). Tool that solves it: a cloud backup service plus an external drive.
Build phishing habits around email
Why it matters: The most common way in is still a fake email that looks like it's from your bank, a supplier, or a delivery company, rushing you to click and log in. Habits beat software here: hover before you click, go to the official site directly instead of using email links for anything financial, and treat unexpected urgency as a red flag. Tool that solves it: your email provider's built-in spam filtering, plus a standing rule that money requests get verified by a phone call to a number you already have.
Follow the one-admin rule
Why it matters: Everyday accounts should be everyday accounts. If the login you browse email with can also install software, change settings, and access everything, then anything that hijacks that session inherits all of it. Tool that solves it: no purchase needed — keep one separate administrator account per system, use it only for admin tasks, and give everyone (including yourself) a standard account for daily work.
Want the tool details behind step 3? Read the best VPN for beginners guide. Setting up your first business site at the same time? See our hosting comparison.