The 10-point checklist
- Turn on two-factor authentication for email, banking, payroll, your website host, domain registrar and social accounts. Email comes first — whoever controls your email can reset everything else.
- Use a password manager and unique passwords for every account.
- Back up important data automatically, keep at least one copy offline or separate from your main systems, and test that you can restore it.
- Update everything — operating systems, browsers, website software, plugins and routers. Turn on automatic updates where possible.
- Train for phishing. Teach your team to pause on urgent requests, unexpected attachments and login links. Real banks and suppliers won't mind you checking.
- Verify payment changes by phone. Invoice fraud — where a criminal impersonates a supplier and "updates" their bank details — is one of the costliest scams for small businesses. Always confirm using a number you already have.
- Limit admin access. Give people only the access they need, and remove it the day someone leaves.
- Secure Wi-Fi. Use strong encryption, change default router passwords, and keep a separate guest network.
- Protect customer data. Collect only what you need, store it in reputable systems, and know your local privacy-law obligations.
- Have a one-page incident plan. Who to call, how to lock accounts, how to contact your bank, and how to inform customers if needed.
Start today: enabling two-factor authentication on your main email account takes about five minutes and stops a large share of account-takeover attempts.
Consider cyber insurance
Cyber insurance can cover incident response, data recovery, business interruption and liability. Insurers increasingly require basics like two-factor authentication and backups before they'll offer cover — another reason to complete the checklist.
Need help locking things down? Get matched with an IT and security provider, or compare cover through business insurance brokers.