In small businesses cybersecurity often belongs to nobody: the owner thinks the technician handles it, the technician only steps in when something breaks, and staff think it's not their concern. The result is that technical measures, even where they exist, remain disconnected. This checklist isn't about products but about organisation: the decisions and habits that make everything else work.
1. Appoint someone responsible
Even in a five-person business someone needs security as part of their job, with dedicated time, even just a few hours a month. It can be the owner, an internal staff member or an external provider with a clear brief. Their minimum duties:
- keeping the inventory up to date;
- checking that backups and updates are working;
- handling staff joining and leaving the accounts;
- being the point of contact for reports.
2. Do you know what you own?
You can't protect what you don't know about. Prepare a simple inventory, even in a spreadsheet, listing:
- devices: computers, company phones, servers, NAS, routers, printers, who uses them and until when they'll receive updates;
- online services: email, accounting, CRM, website, social media, online banking, with the email address of the admin account;
- domains: where they're registered, when they expire, who has access to the control panel;
- important data: where it is and who can access it.
Doing this exercise, many businesses discover that the company domain is registered in the name of a former collaborator, or that the email admin account is tied to a personal address nobody checks any more.
3. Personal accounts, not shared ones
A shared account, such as "office@" with a password everyone knows, makes it impossible to tell who did what and forces a password change every time someone leaves. Where possible:
- each person has their own named account;
- shared mailboxes are assigned as delegated access, not through a common password;
- where a shared account is unavoidable, its password is kept in a business password manager with controlled sharing.
4. Staff joining and leaving
This is one of the most neglected and riskiest moments.
When someone joins
- create the accounts they need, and only those;
- hand over a short guide with the essential rules and the contact for reporting issues;
- turn on two-step verification from day one.
When someone leaves
- disable their accounts the same day, including those on less obvious cloud services;
- change the passwords of shared accounts they had access to;
- collect devices, keys, badges and tokens;
- transfer ownership of files, documents and mailboxes to someone else before deleting the account;
- remove them from groups, company chats and social media pages as an admin.
A written leavers' checklist prevents a former collaborator from keeping access to email or business software for months.
5. Suppliers with access
External technicians, consultants, web agencies, business software vendors: many have access to your systems. Ask yourself:
- who has remote access, and with which tool;
- whether they use named accounts or generic credentials;
- whether their access is protected by a second factor;
- how you're notified when they connect.
Close access that's no longer needed and ask for active access to be protected as well as your own.
6. The technical basics, checked regularly
Setting them up once isn't enough. Every month or quarter, the responsible person checks:
| Check | Suggested frequency |
|---|---|
| Successful backup and test restore | Monthly |
| Updates on systems and exposed devices | Monthly |
| List of active accounts and privileges | Quarterly |
| Supplier access | Quarterly |
| Domain and certificate expiry dates | Every six months |
| Device inventory | Every six months |
7. Short written rules
One page is enough. It should state clearly:
- how bank detail changes and urgent payments are verified;
- where company documents are saved;
- what isn't done with company devices;
- whom to report a problem to, and that reporting carries no penalty.
Long, generic rules don't get read. Short, concrete ones get remembered.
8. A plan for when things go wrong
Write down on paper, outside the company systems, the numbers for your technician, bank, email provider and domain registrar, together with the first actions to take. In an emergency, nobody should have to search for a phone number in a mailbox that may not be working.
In short
- Without someone responsible, security belongs to nobody.
- An inventory of devices, services, domains and data is the starting point.
- Named rather than shared accounts, and immediate deactivation when someone leaves.
- Review and limit supplier access.
- Regular checks and short written rules hold everything else together.