Free Resource

Small Business
Cybersecurity Checklist

20 critical security controls every small business should have in place. Check off what you have — your score updates in real time.

Your Score

0 / 20

60%

of small businesses that suffer a cyberattack close within 6 months. Most were running without the basic protections covered in this checklist.

Access & Passwords

0 / 4

All accounts use strong, unique passwords

Minimum 12 characters, no reused passwords across accounts. Use a password manager like Bitwarden or 1Password.

Critical
Multi-factor authentication (MFA) is enabled

Enabled on email, banking, cloud storage, and any remote access tools.

Critical
Admin accounts are separate from daily-use accounts

Admin privileges should not be used for everyday tasks like browsing or email.

High
Former employee accounts are promptly deactivated

Access should be revoked within 24 hours of an employee departure.

High

Software & Updates

0 / 4

Operating systems are set to auto-update

Windows, macOS, and mobile devices should install security patches automatically.

Critical
Antivirus / endpoint protection is installed and active

All business devices should have active, updated endpoint protection software.

Critical
Business software is licensed and up to date

Unlicensed or outdated software does not receive security patches.

High
Unused software and apps are removed

Every installed application is a potential attack surface. Remove anything not actively used.

Medium

Network & Wi-Fi

0 / 4

Business Wi-Fi uses WPA3 or WPA2 encryption

Never use WEP or open networks for business operations.

Critical
Guest Wi-Fi is on a separate network from business systems

Customers and visitors should never share a network with your business devices.

High
Router default passwords have been changed

Default router credentials are publicly known and actively exploited.

Critical
Firewall is enabled on all devices and the router

Both hardware (router) and software (device) firewalls should be active.

High

Data & Backups

0 / 4

Business data is backed up regularly (3-2-1 rule)

3 copies, on 2 different media types, with 1 stored offsite or in the cloud.

Critical
Backups have been tested and verified restorable

An untested backup is not a backup. Verify restoration at least quarterly.

High
Sensitive customer data is encrypted at rest

Any stored PII, payment data, or health records should be encrypted.

High
A data retention and disposal policy exists

Old data should be securely deleted — not just abandoned on old drives or cloud folders.

Medium

Email & Phishing

0 / 4

Staff have received phishing awareness training

Phishing is the #1 entry point for attackers. All employees should know what to look for.

Critical
Email domain has SPF, DKIM, and DMARC records configured

These DNS records prevent attackers from spoofing your business email domain.

High
There is a clear process for reporting suspicious emails

Employees should know exactly who to contact if they suspect a phishing attempt.

Medium
Business email is hosted on a professional platform

Avoid personal Gmail/Yahoo for business. Use Google Workspace, Microsoft 365, or similar.

Medium

// Your Security Score

0 / 20

0 – 7

High Risk

Significant gaps present. Immediate action recommended.

8 – 14

Moderate Risk

Good start, but key vulnerabilities remain unaddressed.

15 – 20

Strong Posture

Well protected. Focus on maintaining and testing regularly.

Find out exactly where you stand.

Root Command IT offers free 30-minute security assessments for local small businesses. No sales pitch — just a clear picture of your risk and what to do about it.

Book Free Assessment

Download PDF

Small BusinessCybersecurity Checklist

Access & Passwords

Software & Updates

Network & Wi-Fi

Data & Backups

Email & Phishing

// Your Security Score

Find out exactly where you stand.

Small Business
Cybersecurity Checklist