Small business cyber readiness

Use this working checklist with the person who manages your systems. Tick completed actions, download your progress or print a copy for your next review.

0 of 8 actions complete

• List business systems, devices, data owners and the people who hold administrator access.
• Turn on multi-factor authentication for email, finance, administrator and other important accounts. Use phishing-resistant methods where supported.
• Remove unused accounts. Give each person a named account and only the access their work needs.
• Confirm who installs operating system and application updates, and how exceptions are tracked.
• Check endpoint protection and encryption status on company devices. Record unresolved gaps.
• Keep protected backup copies and test recovery of a representative file and a critical system.
• Record an incident contact, escalation route and a way to communicate when company email is unavailable.
• Give staff a simple process to report suspicious messages. Repeat this review after a major system or staffing change.

Turn the list into a plan

Assign one owner and a review date to each unfinished action. Start with accounts that control money or sensitive information. This checklist supports preparation and does not certify compliance.

Official reading

• NIST Small Business Cybersecurity Corner

Prepared for operational planning · Reviewed 7 November 2026. Check official guidance for changes and requirements that apply to your circumstances. Checklist progress stays on this page until you leave or reload.