Small-business security checklist

You don't need a big security budget. These ten steps, roughly in order of value, stop most of what hits small businesses.

The checklist

1. Two-step sign-in on e-mail, banking, and every admin or remote-access account
2. Backups with an off-site copy, tested by actually restoring a file
3. Updates turned on for computers, phones, routers and key software
4. A password manager, and no shared or reused passwords
5. Each person has their own accounts; admin rights only for those who need them
6. Accounts turned off the day someone leaves
7. Disk encryption on every laptop
8. A separate guest Wi-Fi for customers and personal devices
9. Staff who know how to spot a scam e-mail, and who to tell
10. A one-page plan for who to call if something goes wrong

Check it twice a year

Walk through the list in spring and autumn. Most problems come from things that slipped: a backup that stopped, an old account still active, a router that stopped getting updates.

We do a plain-English security check for small businesses and fix the gaps in order of importance.

More tips

• How to spot a scam e-mail in 30 seconds
• Is your backup actually working?
• Wi-Fi keeps dropping? Try this first
• What to do if your e-mail or an account gets hacked
• All tips