Cybersecurity for Small Business: The Practical 2026 Checklist

Start with accounts. The single most effective control is unique, strong passwords plus two-factor authentication on every account that matters - email, banking, cloud. An attacker who gets one password should not get your whole business. A password manager makes this practical; our covers the setup.

Back up everything, test the restore. Ransomware is the biggest financial threat to small businesses, and the defence is backups that attackers cannot reach: automated, offline or immutable, and tested. A business that can restore from backup can tell a ransomware attacker no - which is the whole point.

Patch what you can, replace what you cannot. Most breaches exploit known vulnerabilities in unpatched software. Automate updates, and phase out software that no longer receives security patches. The list of things to keep patched: operating systems, browsers, cloud apps and any internet-facing device.

Control access, not just the perimeter. The least-privilege principle - everyone gets only the access they need - limits the blast radius of any compromised account. Review who has admin rights and remove stale accounts, especially for former employees. This is cheap, boring and disproportionately effective.

Train the human layer. Phishing remains the most common entry point. Regular, short, practical training - and a simple reporting channel - turns employees from the weakest link into a working alarm system. The goal is not to make everyone a security expert; it is to make “think before you click” a habit.

Have a plan for the bad day. Every business will eventually face an incident - a phishing email that slips through, a laptop stolen, a suspicious charge. The plan is three things: who to call, what to disconnect, and how to restore from backup. Written down and rehearsed, an incident goes from panic to process.

The vendor layer is the new attack surface.

Your security now includes everyone you email. The dominant breach paths for small businesses no longer require breaking your network: they arrive through a vendor's compromised account, a SaaS tool with excessive permissions, or a supplier whose invoice email was hijacked. Map the third parties that can move your money or your data - payment providers, payroll, the IT contractor, the SaaS tools with customer data - and give each the same questions you would demand of an employee: who can access what, with which authentication, and how would you know if they were compromised. Least privilege applies to vendors most of all, because you cannot train their staff.

Wire transfer fraud is the small-business epidemic. The pattern is simple and profitable: compromise or impersonate a supplier, send a plausible invoice with changed bank details, collect. The defence is procedural, not technical - out-of-band verification for any change of payment details, a second approver for payments above a threshold, and a standing rule that bank-detail changes are never trusted from email alone. This one process, drilled into the accounts payable routine, blocks the most common way small businesses lose five-figure sums in a single morning.

Cyber insurance forces the baseline anyway.

The insurer's checklist is a decent security programme. Cyber insurance applications now demand the controls that were previously "someday" items: MFA everywhere, tested backups, endpoint detection, an incident contact, staff awareness. Treat the questionnaire as free consulting - it is a prioritised list of the controls that actually decide breach outcomes, ranked by insurers who have paid out enough claims to know. The premium difference between compliant and non-compliant small businesses has widened enough that the controls largely pay for themselves in the premium, before counting a single prevented incident.

Practice the bad day, briefly. The difference between an incident and a catastrophe is usually the first hour: who turns off what, who calls whom, who talks to customers. A one-page incident plan with real names and phone numbers, rehearsed once in a tabletop exercise (an hour, a conference room, a scenario), converts panic into checklist. Small businesses rarely need a security department; they need the first hour scripted and the insurer's number saved.