Small Business IT Security Checklist

A small business does not need an enormous security programme to improve its resilience. It does need visibility: knowing which accounts, devices, services and data matter most, who can access them, how they are protected and what happens when something goes wrong.

This checklist is designed as a practical starting point. It is not a certification or a guarantee that a business is secure. A “No” answer is simply an indication that an area deserves investigation.

How to use this checklist

Work through each section with the person responsible for IT. Tick an item only when you can explain how the control works and where the evidence is. Keep a short list of gaps and prioritise the items that could have the greatest operational impact.

1. Identity and access

Identity is often the first control to review because a compromised account can provide access to email, files, cloud applications and other services. Prioritise administrator accounts and other accounts that would cause significant harm if compromised.

Critical accounts are identified.
We know which accounts control Microsoft 365, domain names, hosting, finance, payroll, banking and other critical services.

MFA is enabled for important accounts.
High-value accounts use MFA, 2-step verification, passkeys or another strong authentication method where supported.

Administrator access is limited.
People have privileged rights only when their role requires them.

Admin and everyday accounts are separated where practical.
Privileged accounts are not routinely used for normal email and web browsing.

Former users and suppliers are removed.
Leavers and completed supplier engagements trigger an access review.

2. Microsoft 365 and cloud services

Cloud services can simplify IT, but the organisation remains responsible for how identities, permissions and data are configured. The aim is not to enable every security feature indiscriminately; it is to understand which controls are appropriate and whether important exceptions exist.

Microsoft 365 administrators are known and reviewed periodically.

MFA coverage and any exceptions are documented.

Guest access and external sharing are reviewed.

Mailbox forwarding and other unusual external data flows are reviewed.

Security alerts have an identified owner and an escalation route.

The business understands what its Microsoft 365 services protect and where additional backup or recovery controls may be required.

3. Devices and software

Laptops, desktops and mobile devices can contain business data and active sessions to cloud services. A useful device baseline starts with knowing what exists and keeping supported systems protected and maintained.

Business devices are inventoried or otherwise accounted for.

Operating systems and important applications are supported and receive security updates.

Endpoint protection is active and monitored where appropriate.

Screen locking and device encryption are enabled where supported and appropriate.

Users do not routinely have unnecessary local administrator privileges.

There is a process for lost, stolen or compromised devices.

4. Email and phishing

Email remains central to many businesses and is attractive to attackers because one compromised mailbox can expose conversations, documents and password-reset messages. Technical controls should be reinforced by simple staff procedures.

Staff know how to report suspicious emails and unexpected sign-in prompts.

Unexpected payment or bank-detail changes are independently verified using a trusted contact method.

Domain email authentication such as SPF, DKIM and DMARC has been reviewed where applicable.

External forwarding and other unusual mailbox rules are periodically reviewed.

Staff receive practical security awareness guidance rather than relying only on annual policy documents.

5. Backup and recovery

Having a backup is not the same as having a tested recovery capability. The important question is whether the business can restore the information and systems it needs after accidental deletion, hardware failure, account compromise, ransomware or another disruption.

Critical business data has been identified.

Important data is covered by an appropriate backup or recovery arrangement.

Backup retention is understood.

Access to backups is restricted and protected.

A real restoration test has been completed and recorded.

The business knows who is responsible for initiating recovery.

6. Suppliers, applications and third-party access

Small businesses often depend on accountants, web agencies, IT providers, software vendors and other third parties. Their access should be treated as part of the wider security picture.

Third-party accounts and integrations are documented.

Supplier access is limited to what is necessary.

Access is removed when the engagement ends.

Critical suppliers have known support and escalation contacts.

Important SaaS services have a clear owner inside the business.

7. Incident readiness

When something suspicious happens, people should know what to do. A simple response process is often more useful than a long document nobody can find.

There is a named person or team responsible for receiving security incidents.

Staff know how to report a suspicious email, login, device or payment request.

The business knows how to disable or protect a compromised account.

Important evidence such as messages, alerts and timestamps can be preserved.

Key external contacts are recorded, including IT support, critical suppliers and relevant professional advisers.

8. Review the baseline regularly

Security changes as the business changes. New employees, new devices, new applications, new suppliers and new cloud services can all create access or configuration changes.

Administrator and privileged access is reviewed periodically.

Leavers and old supplier access are checked.

Unsupported devices and software are identified.

Backups and at least one restoration test are reviewed.

Security incidents and near-misses are reviewed for lessons learned.

The business keeps a short, current list of its most important systems and contacts.

What should you fix first?

If you find several gaps, do not try to fix everything simultaneously. A practical sequence is to start with the controls that protect access and recovery.

Priority 1 — Critical access

Secure administrator and other high-value accounts, enable strong authentication and remove unnecessary access.

Priority 2 — Devices & email

Address unsupported devices, missing updates, endpoint protection and practical phishing/payment-verification processes.

Priority 3 — Recovery

Identify essential data, verify backup coverage and perform a genuine restoration test.

Priority 4 — Response

Make sure staff know who to contact and what to do when something suspicious happens.

NorthWave practical approach

Use the checklist to find gaps — not to chase a perfect score.

The most useful outcome is a short, prioritised list of actions that improves access control, device security, data recovery and incident readiness.

Book a Free IT Health Check →

Further guidance

For additional UK-focused guidance, the National Cyber Security Centre provides resources for small organisations covering areas such as accounts, devices, email, backups and recognising attacks.

This checklist provides general information for business planning. It is not a certification, penetration test, legal opinion or guarantee of security.