Small Business Cybersecurity: A Practical Checklist

Small businesses get breached far more often than the headlines suggest. Attackers know a ten-person company rarely has a security team, and they automate their way through thousands of them at once. The good news: most small business breaches come down to a handful of gaps, and every one of them is fixable. Here is the checklist we actually work through with businesses across LA and Orange County, in plain language and in order of what matters most.

Why small businesses are the easy target

It is a myth that attackers only go after big companies. The opposite is true. Large firms have security staff and budgets; a small business with a few employees and a shared password usually does not. Automated attacks do not care how big you are, only how open you are.

The cost of a breach is also harder on a small business. A few days of downtime, a drained bank account, or lost client trust can do real damage to a company that has no cushion. Prevention is far cheaper than recovery.

Turn on multi-factor authentication everywhere

If you do one thing this week, do this. Multi-factor authentication, the code or prompt on your phone after your password, stops the large majority of account break-ins on its own. Most stolen passwords are useless to an attacker once it is on.

Start with the accounts that would hurt the most: email, banking, your Microsoft 365 or Google Workspace, and anything that holds client data. Then work outward to the rest.

• Turn on MFA for email and financial accounts first.
• Use an authenticator app or prompt rather than text messages where you can.
• Make it required for every employee, not optional.

Put real protection on every device

Free, built-in antivirus is better than nothing, but it is not built for a business that holds client data and runs on email all day. Business-grade endpoint protection adds ransomware defense, web filtering, and central visibility so one infected laptop does not become everyone's problem.

This is the layer we deploy for the businesses we protect. It is managed from one console, so a threat on any device is caught and contained before it spreads. The same tools are available to you directly at a discount in our store, and we are happy to set them up for you if you would rather not.

• Use business-grade protection, not consumer free antivirus, on every workstation and server.
• Make sure it includes ransomware defense with rollback.
• Manage it centrally so you can see every device in one place.

Train the people, not just the machines

Most breaches start with a person, not a server. A convincing email, a fake invoice, a login page that looks real: these get through technology because they target the human. Short, regular training does more than any single product to close that gap.

You do not need a formal program to start. A ten-minute conversation about how to spot a suspicious email, repeated a few times a year, measurably lowers your risk.

• Teach staff to slow down on anything urgent about money or passwords.
• Verify payment or banking changes by phone, never by email alone.
• Make it safe for employees to report a mistake quickly.

Back up so you can actually recover

A backup you have never tested is a guess, not a safety net. The point of a backup is the restore, and the time to find out it does not work is not the morning after a ransomware attack.

Good backups are automatic, kept separate from your main systems, and tested on a schedule. If an attacker encrypts everything, a clean, recent backup is what gets you back to work without paying a ransom.

• Automate backups so they do not depend on someone remembering.
• Keep at least one copy offline or in a separate cloud account.
• Test a real restore at least a few times a year.

Know when to bring in help

You can handle the first few items on this list yourself, and you should. But once you have employees, client data, and more than a couple of locations, security becomes a job rather than a task. That is the point where a partner pays for itself.

We do this for small businesses across LA and Orange County: one accountable person who knows your setup, with vetted specialists brought in when a project calls for it. If you want to know where you stand, a free on-site assessment is the place to start.

Common questions