10 security basics every small business should have

A plain-English checklist that stops most real-world attacks — no security team required.

Most attacks on small businesses aren’t sophisticated. They’re stolen passwords, fake invoices and unpatched software. The good news: a handful of basics stops most of them.

1. Turn on multi-factor authentication (MFA) everywhere

Email, banking, accounting, social media, your website admin. If an account supports MFA, turn it on. Prefer an authenticator app or passkey over SMS codes.

2. Use a password manager

One strong, unique password per account. A password manager (Bitwarden, 1Password, Apple Passwords) makes this painless and stops one leaked password from unlocking everything.

3. Secure your email first

Your email resets every other password, so it’s the master key. Give it the strongest protection, and check who else has access to it.

4. Keep backups — and test them

Follow the 3-2-1 rule: three copies, on two different types of storage, one kept offline or off-site. A backup you’ve never restored is a hope, not a backup.

5. Update everything, automatically

Turn on automatic updates for computers, phones, routers, website plugins and apps. Most attacks use holes that were already fixed.

6. Verify payment changes by phone

“We’ve changed our bank details” emails are one of the most expensive scams around. Always confirm by calling a number you already have — never one from the email.

7. Set up SPF, DKIM and DMARC on your domain

These three DNS records stop criminals from sending email that looks like it came from your business. Your email provider has a guide; it takes about 15 minutes.

8. Remove access when people leave

Keep a simple list of who has access to what. When someone leaves, remove their accounts the same day.

9. Separate admin accounts from everyday ones

Don’t browse the web or read email while logged in as an administrator. Use admin accounts only when you need them.

10. Know what you’d do if something went wrong

Write down, on one page: who to call, how to lock accounts, where the backups are. Panic is the enemy; a plan beats it.

Want someone to check these for your business? Get in touch — I’ll tell you plainly what’s fine and what needs fixing.