A pro’s 30-minute cybersecurity check for small businesses
For small-business owners, a cybersecurity review can start with basic questions, Verizon notes: Who has access to business accounts? Is multifactor authentication turned on? Where does sensitive information live? Are backups available, and can the business recover its data?
And it only takes about 30-minutes to organize those questions into a simple checklist and set up a plan for anything that needs follow-up. Its purpose is to identify three priorities and clarify when outside help may be needed.
This checklist can be created in a spreadsheet or on paper. It should contain descriptions of information and systems, rather than passwords, account numbers or actual customer information, and the completed checklist should be stored securely. Any answer that takes more than a few minutes to find can be marked “unknown” and revisited later.
The first 5 minutes: Map the information the business needs to protect
The spreadsheet begins with three columns:
- What am I protecting?
- Where does it live?
- Who can access it?
The entries identify information the business depends on or has been trusted to keep private, such as customer and employee data, payment information, contracts, financial information or health information.
Contracts might live on a laptop and a cloud drive. Payroll may go through an outside service. Invoices may arrive through email. Each system and the people who can access it belong on the map.
The following example uses hypothetical entries:
An unknown location or access arrangement becomes a follow-up item.
Minutes 5–10: Check protection on important accounts
A fourth column records the next question: What protections have I verified?
The review starts with accounts whose compromise could significantly disrupt the business, including email, banking, payroll, cloud storage, booking systems and administrator accounts.
One protection to verify is multifactor authentication, or MFA, which requires more than a password to sign in. NIST recommends enabling MFA on every account that offers it. MFA adds protection, although it does not eliminate every risk.
Passwords shared through email or stored in an unprotected document can also be flagged for follow-up. NIST recommends strong passwords and considering a password manager.
At this stage, the hypothetical spreadsheet might look like this:
For systems with multiple users, the review should distinguish which accounts have MFA enabled. A protection verified for the owner’s account should not be assumed to apply to every employee account.
Minutes 10–15: Identify what providers protect
The next stage connects each system on the map with the provider or person responsible for its security.
Internet providers, mobile carriers, email providers, booking platforms and other technology companies may offer security features. The review establishes what is included, what is active and what remains the business’s responsibility.
Questions for each relevant provider include:
- What security is already active?
- Is a firewall enabled on the business router, and who manages its settings?
- Is spam filtering, phishing protection or mobile security included?
- Are any included protections waiting to be activated?
- What remains the business’s responsibility?
- Is sensitive business information encrypted where it is stored and when it is shared, including on devices, cloud services and backups?
Answers that cannot be confirmed within the allotted time remain “unknown,” with a follow-up assigned to the relevant provider or administrator.
The fourth column records the specific system and protection verified. The examples below illustrate how findings can accumulate; they do not establish that every part of a system is secure.
Minutes 15–20: Establish a rule for payment changes
The review next identifies rows connected to people or companies the business regularly pays: employees, vendors, contractors, payroll providers, landlords or other business partners.
A sudden request to change payment instructions can be part of a business email compromise scam. The FBI describes schemes in which criminals impersonate familiar contacts or gain access to legitimate billing conversations to redirect money.
A payment-verification rule gives staff a consistent response: Changes to bank details or payment procedures require confirmation through a separate, trusted channel before money is sent.
For example, an email containing new bank details or a different payment link should be verified by calling the vendor using a previously established phone number, rather than a number supplied in the message. The FBI recommends independently verifying payment requests and changes to account numbers or payment procedures.
The checklist can record whether the people responsible for payments understand and follow that procedure.
Minutes 20–25: Review backups and recovery
A fifth column captures the next question: What do I need to do next?
For the systems that matter most, the review records answers to three questions:
- What is backed up?
- When was the last successful backup?
- Has someone tested restoring the data?
NIST’s small-business cybersecurity guidance recommends backing up business data regularly and establishing measures to protect and test those backups.
Any missing answer becomes a task in the final column. The spreadsheet now brings together information, access, verified protections and unresolved issues:
For a broader review, the Center for Internet Security’s Implementation Group 1 provides a foundational set of safeguards for essential cyber hygiene, including guidance intended for organizations with limited cybersecurity resources.
Businesses using Microsoft 365 can also ask their administrator to review Microsoft Secure Score, which tracks recommended security actions, and explain which improvements apply to their setup.
Minutes 25–30: Assign three priorities
The final five minutes turn the last column into an action plan.
The owner selects three priorities. Each receives a person responsible, a completion date and a way to verify that the work is finished. For example, enabling payroll MFA becomes a task assigned to a specific person, with a deadline and a subsequent check of the account settings.
Unresolved questions may also point to a need for a cybersecurity professional or managed service provider to assess existing protections and help prioritize improvements.
A separate follow-up can address cyber insurance and crime coverage. Questions for an insurance professional include whether payment fraud is covered, which exclusions or limits apply and what security requirements the business must meet.
At the end of the exercise, the checklist documents what the business holds, who can access it, which protections have been confirmed and what still needs attention. Those findings provide a starting point for follow-up with staff, providers and security professionals.
Regis DeVeaux is the owner and Chief Nerd of NerdsToGo in Alexandria, Virginia, and a cybersecurity advisor who works with small businesses and government contractors to identify security risks, strengthen their systems and build practical cybersecurity habits.
This story was produced by Verizon and reviewed and distributed by Stacker.
