Cybersecurity advice for small business tends to fall into two camps: vague platitudes about "taking security seriously," or enterprise-level frameworks that assume you have a dedicated security team and a big budget. Neither is particularly useful if you're running a 15-80 person business and just want to know what you should actually have in place.
This is a practical checklist - the controls that make the biggest difference for businesses at this scale, in priority order.
1. Multi-Factor Authentication (MFA)
What it is: A second verification step when you log in - usually a prompt or code on your phone, on top of your password.
Why it's first on this list: It's the single highest-impact thing you can do. MFA blocks over 99% of automated attacks on accounts. If someone gets hold of a password, MFA stops them at the door.
What good looks like:
- MFA turned on for every user - especially admin accounts
- An authenticator app on your phone rather than text message codes (text messages can be intercepted)
- Start with email - it's the key to password resets on everything else
Common gaps: MFA available but not enforced (so people skip it), or admin accounts left without it.
2. Endpoint Protection
What it is: Security software on every device that connects to your business - laptops, desktops, and phones.
Why it matters: Devices are where attacks land. A phishing link gets clicked on a laptop. A phone with access to company email gets lost. If your devices aren't protected, everything behind them is exposed.
What good looks like:
- Modern security software (not just basic antivirus) on every device, managed centrally so your IT team can see what's happening
- Encryption turned on so a lost laptop isn't automatically a data breach
- Company phones included, not just computers
Common gaps: Personal devices accessing company systems with no protection, or Macs left out because "Macs don't get viruses" (they do).
3. Backups
What it is: Copies of your data and systems stored separately, tested regularly, and ready to restore when something goes wrong.
Why it matters: Backups are your safety net. Whether it's ransomware, hardware failure, accidental deletion, or anything else - if your backups are solid, you can recover. If they're not, you're in real trouble.
What good looks like:
- Multiple copies of your data, with at least one stored offsite or in the cloud
- Backups covering everything important - not just files, but email, databases, and system settings
- Regular automated schedule - daily at minimum for critical data
- Tested restores. This is the one that gets skipped. A backup you've never tested is just an assumption. Test it quarterly. Know how long recovery takes before you need it.
- Backups stored separately from your main systems - ransomware specifically goes after backups it can reach
Common gaps: Backups running but never tested, Microsoft 365 data not backed up (Microsoft's built-in retention isn't a backup), or no offsite copy.
4. Security Awareness Training
What it is: Regular, practical training that helps your team spot and respond to threats - mainly phishing and scam emails.
Why it matters: Most breaches start with a person clicking something they shouldn't. Training doesn't eliminate that, but it dramatically reduces the odds and helps people report suspicious things quickly.
What good looks like:
- Short, regular sessions - monthly or quarterly, not a single annual video everyone forgets
- Simulated phishing to test awareness in a safe, blame-free way
- Training that uses real-world examples, not generic slides
- A clear message that reporting something suspicious is always the right thing to do
Common gaps: Training done once at onboarding and never repeated, no simulated phishing, or a culture where people are afraid to report mistakes.
5. Software Updates (Patching)
What it is: Keeping your operating systems, applications, and equipment up to date with security fixes.
Why it matters: Known security holes with available fixes are the easiest targets for attackers. Updating closes those doors.
What good looks like:
- Critical security updates applied within days, not weeks
- Automatic updates turned on where possible for operating systems, browsers, and common software
- Don't forget your router, firewall, and other network equipment - these often get overlooked
Common gaps: Updates deferred because "we can't afford the downtime," or network equipment running old software nobody's checked in years.
6. Monitoring
What it is: Keeping an eye on what's happening across your systems - who's logging in, what's being accessed, and whether anything unusual is going on.
Why it matters: Without monitoring, you only find out about problems when someone complains or the damage is done. Attackers can sit inside a network for weeks before being noticed if nobody's watching.
What good looks like:
- Alerts on suspicious activity - failed login attempts, logins from unexpected locations, unusual access patterns
- Someone actually reviewing those alerts, not just collecting them
- Monitoring that covers after-hours too - attacks don't wait for business hours
Common gaps: Alerts set up but ignored due to overload, or cloud services like email not included in monitoring.
Putting It Together
You don't need to tackle all of this at once. Start with MFA and verified backups - they're your two highest-value controls. Everything else builds on that foundation.
The thing that ties it all together is someone being accountable for making sure these controls are actually working - not just set up once and forgotten, but maintained, tested, and reviewed. Whether that's an internal person or an external provider, the worst outcome is security that looks good on paper but hasn't been checked in practice.
If you're not sure where your gaps are, working through this list honestly is a solid starting point. Most of what's here isn't expensive or disruptive - it just needs to be done deliberately.