A cybersecurity checklist for small businesses

Most attacks on small businesses aren't sophisticated. They're a convincing email, a reused password or a laptop without a backup. This checklist covers the basics we set up first for offices on Staten Island and across New York City.

1. Turn on two-factor sign-in

Start with email, banking, payroll and anything that holds client data. A stolen password alone is then not enough to get in. Codes from an authenticator app, or a security key, are stronger than codes sent by text.

2. Use a password manager

Every account gets its own long, random password, and nobody has to remember or share them. When someone leaves, you can see and remove what they had access to.

3. Protect your email domain

SPF, DKIM and DMARC are DNS records that tell other mail servers which senders are really you. Without them, anyone can send email that looks like it came from your address, which is how many fake-invoice scams start.

4. Verify payment changes by phone

If a vendor or client emails new bank details, call them on a number you already have before sending money. This one habit is the simplest defense against invoice fraud.

5. Back up, and test the backup

Keep at least one copy of your important files somewhere ransomware can't reach, such as an offline drive or a cloud backup that can't be changed or deleted. A backup you've never restored from is a guess, so test it.

6. Keep devices updated

Turn on automatic updates for computers, phones and routers, and replace equipment that no longer gets security updates.

7. Put guests on a separate Wi-Fi network

Visitors and smart devices belong on a guest network, away from the computers that hold client records.

8. Remove access the day someone leaves

Keep a short checklist for departures: email, shared drives, software accounts and door codes. Old accounts are an easy way in.

9. Train your team to spot scams

Short, regular refreshers on phishing emails, fake login pages and urgent phone requests work better than one long session a year.

10. Write it down

A one-page plan for who to call and what to do if something goes wrong saves hours in a stressful moment, and it's the start of the written safeguards many regulations expect.

What New York law expects

New York's SHIELD Act requires any business that holds private information about New York residents to maintain reasonable administrative, technical and physical safeguards, and what counts as reasonable for a small business scales with its size and the sensitivity of the data. Medical and dental offices also have HIPAA, and lenders and mortgage brokers have the FTC Safeguards Rule. This checklist isn't legal advice, but it covers much of the groundwork those rules share.

Want a hand?

We do security assessments for small offices: a review of your accounts, email, devices and backups, and a plain-language list of what to fix first.