Small businesses are not too small to target. Attacks are automated: they try thousands of mailboxes and networks and go wherever the door is open. The good news is that most of those doors are easy to close.
Work through this list with whoever handles your IT. Anything you can't answer “yes” to is the place to start.
- 1
Multi-factor sign-in on every email account
A stolen password is the most common way into a small business. Multi-factor sign-in (a code or app prompt on your phone) stops most of those attempts. Turn it on for everyone, starting with the owner and whoever handles money.
- 2
Backups you have actually restored from
Keep at least one copy of your important files somewhere other than the office, and one that ransomware cannot reach. Then test it: pick a file, restore it, and open it. A backup nobody has tested is a hope, not a backup. Microsoft 365 mail and OneDrive need their own backup too.
- 3
Updates installed on a schedule
Windows, Office, browsers and the router all get security fixes. If updates depend on each person clicking "later", some machines are months behind. Set them to install automatically, or have someone check every machine monthly.
- 4
Real endpoint protection on every computer
Built-in antivirus is a start. Business endpoint protection watches for ransomware-like behaviour, not just known viruses, and can isolate a machine before the infection spreads.
- 5
Nobody works as an administrator day to day
Staff accounts should not have admin rights on their computers or in Microsoft 365. Keep a separate admin account for setup work, so one clicked link cannot install software across the office.
- 6
Email filtering and a habit of checking before paying
Most attacks start with an email. Use the filtering you already pay for, and agree on one rule: any request to change banking details or send money urgently gets confirmed by phone, using a number you already have.
- 7
Staff who know what phishing looks like
A short training session and the occasional practice email do more than any policy document. Make it easy and blame-free to report "I think I clicked something".
- 8
A guest Wi-Fi that is separate from the office
Visitors, personal phones and smart devices belong on a guest network, not the one your server and office computers use. Change the router’s default admin password while you are there.
- 9
A leaver checklist
When someone leaves, disable their accounts the same day, change any shared passwords they knew, and collect company devices. Old accounts that still work are an easy way in.
- 10
Know who to call, and when
Write down who handles a security problem, how to reach them after hours, and what to do first (unplug the affected computer from the network; do not turn it off or pay anyone). Five minutes of planning saves hours of panic.
You may already own most of the tools
If your business is on Microsoft 365 Business Premium, much of this list (multi-factor sign-in, endpoint protection, email filtering, device management) is already in your subscription, just switched off. Here is the security in Business Premium you're probably not using.
The part a checklist can't do
A checklist gets you set up. It does not watch for the attack that happens at 2 a.m. on a Sunday. That is what a security operations centre is for: people watching every machine around the clock and stepping in when something looks wrong.
At Specter Systems, the managed IT plans for Windsor-Essex businesses cover this list in steps: updates, monitoring and Microsoft 365 administration on every plan, backups from the Managed plan up, and 24/7 monitoring by a security operations centre, staff training and phishing tests on Managed + Security. See what is covered on the cybersecurity page.
Not sure where you stand?
A free 30-minute assessment shows where your business stands, and you keep the findings either way.