Free Resource

Small Business
Cybersecurity Checklist

20 critical security controls every small business should have in place. Check off what you have — your score updates in real time.

Your Score

0 / 20

essential controls across five categories. These are the safeguards insurers, auditors, and customers most often ask small businesses to demonstrate.

Access & Passwords

0 / 4

All accounts use strong, unique passwords

Minimum 12 characters, no reused passwords across accounts. Use a password manager like Bitwarden or 1Password.

Critical
Multi-factor authentication (MFA) is enabled

Enabled on email, banking, cloud storage, and any remote access tools.

Critical
Admin accounts are separate from daily-use accounts

Use separate admin accounts for elevated tasks. Everyday browsing and email should use standard user accounts.

High
Former employee accounts are promptly deactivated

Access should be revoked within 24 hours of an employee departure.

High

Software & Updates

0 / 4

Operating systems are set to auto-update

Windows, macOS, and mobile devices should install security patches automatically.

Critical
Antivirus / endpoint protection is installed and active

All business devices should have active, updated endpoint protection software.

Critical
Business software is licensed and up to date

Licensed, supported software receives ongoing security patches from the vendor.

High
Unused software and apps are removed

Keep only the applications your business actively uses. Fewer installed apps means a smaller attack surface.

Medium

Network & Wi-Fi

0 / 4

Business Wi-Fi uses WPA3 or WPA2 encryption

WPA3 or WPA2 encryption is required for all business Wi-Fi.

Critical
Guest Wi-Fi is on a separate network from business systems

Customers and visitors use a dedicated guest network, separate from business systems.

High
Router default passwords have been changed

Default router credentials are publicly known and actively exploited.

Critical
Firewall is enabled on all devices and the router

Both hardware (router) and software (device) firewalls should be active.

High

Data & Backups

0 / 4

Business data is backed up regularly (3-2-1 rule)

3 copies, on 2 different media types, with 1 stored offsite or in the cloud.

Critical
Backups have been tested and verified restorable

Test your backups by restoring a file or mailbox at least quarterly to confirm they work.

High
Sensitive customer data is encrypted at rest

Any stored PII, payment data, or health records should be encrypted.

High
A data retention and disposal policy exists

Retire old data through secure deletion on drives and cloud folders when it is no longer needed.

Medium

Email & Phishing

0 / 4

Staff have received phishing awareness training

Phishing is the #1 entry point for attackers. All employees should know what to look for.

Critical
Email domain has SPF, DKIM, and DMARC records configured

These DNS records prevent attackers from spoofing your business email domain.

High
There is a clear process for reporting suspicious emails

Employees should know exactly who to contact if they suspect a phishing attempt.

Medium
Business email is hosted on a professional platform

Avoid personal Gmail/Yahoo for business. Use Google Workspace, Microsoft 365, or similar.

Medium

// Your Security Score

0 / 20

0 – 7

High Risk

Significant gaps present. Immediate action recommended.

8 – 14

Moderate Risk

Good start, but key vulnerabilities remain unaddressed.

15 – 20

Strong Posture

Well protected. Focus on maintaining and testing regularly.

Find out exactly where you stand.

Root Command IT offers a free security call for small businesses. No sales pitch — just a clear picture of your risk and what to do about it.

Book a Free Security Call

Download PDF

Small BusinessCybersecurity Checklist

Access & Passwords

Software & Updates

Network & Wi-Fi

Data & Backups

Email & Phishing

// Your Security Score

Find out exactly where you stand.

Small Business
Cybersecurity Checklist