The 10-Point Cybersecurity Checklist Every Small Business Should Run Monthly

Most small businesses are not breached by a genius. They are breached by something ordinary: a laptop that skipped three months of updates, an account still active for someone who left in spring, a backup job that has been failing quietly since January. None of that is dramatic, which is exactly why it goes unnoticed.

The fix is not a bigger budget. It is a short, repeatable routine. Here is a ten-point check you can run in an afternoon, once a month. Put it on the calendar, give it one owner, and write down what you find. The value comes from running it again next month.

1. Patch Everything That Touches Your Business

Attackers overwhelmingly use flaws that already have a fix available. Your job is simply to close that window faster than they can walk through it.

Start with operating systems and browsers, then work outward: VPN clients, the accounting package nobody thinks about, the router, the network storage box, VoIP handsets, even the office printer. Many patches only take effect after a restart, so a machine that was updated but never rebooted is still exposed.

Pick a fixed day each month and pull the update report from whatever tool manages your devices. If you do not have one, walk the office and check each machine by hand. Keep a simple list of every device that holds company data, because the point of the list is to notice the one that never appears in any report.

The devices people forget

Firmware is where small businesses get surprised. Set routers, firewalls and NAS devices to update automatically where the vendor allows it. If a vendor has stopped shipping security updates for hardware you still rely on, that is a replacement decision, not a patching one.

2. Turn On Multi-Factor Authentication and Clean Up Passwords

Protect email first. Almost every other account can be reset through it, so email is the master key to your business. Then do banking, payroll, remote access and any admin console.

App-based codes or a hardware key are stronger than text messages, which can be intercepted or SIM-swapped. Pair MFA with a password manager so nobody is reusing a password across work and personal accounts. If a shared login genuinely cannot be avoided, name one person who owns it and knows who else has the credentials.

Once a month, open the sign-in or audit log for your key systems. Look for failed login bursts and successful logins from places your staff do not work from. Most providers show this in two or three clicks.

3. Run an Access Review, Not Just a Password Change

Access drifts. People change roles, contractors finish projects, and permissions accumulate because removing them feels like extra work. Once a month, go through the list and ask one question: does this person still need this, today?

• Anyone who left the company, including temporary staff and interns.
• Anyone who changed roles in the last 60 days.
• Contractors, accountants and IT vendors with remote access.
• Admin and service accounts, which should be few and named.
• Shared drives, cloud folders and the guest Wi-Fi password.

If you are unsure whether an account is still needed, disable it for 30 days rather than deleting it. You keep the audit trail and mail flow, and if someone complains, you have found a process worth documenting.

4. Prove Your Backups Can Actually Be Restored

A backup that has never been restored is a hope, not a plan.

Check the last successful run, then look past it: warnings, skipped files, storage that is nearly full, credentials that expired last week. Confirm you have at least one copy that ransomware cannot reach from the network, whether that is an offline drive or immutable cloud storage.

Then restore something. Pull back a single folder and time it. It should take minutes, not a morning. Once a quarter, restore a whole machine or critical system so you know the procedure works when you are under pressure and the person who set it up is on holiday.

5. Check Endpoints, Encryption and Admin Rights

Every device that holds company data should have disk encryption switched on, an automatic screen lock, working endpoint protection, and automatic updates. Check that protection is actually reporting in, not just installed — a tool that has not phoned home since March is not protecting anything.

Remove daily admin rights from normal user accounts so malware cannot install itself silently. Document any personal devices allowed to access company email or files, and make sure the same rules apply to them.

On the network side: keep guest Wi-Fi separate from internal systems, require MFA for remote access, and change default administrator passwords on routers, switches and printers.

6. Keep the Human Layer Sharp

Most incidents start with a message, not a vulnerability. The two that cause the most damage are invoice fraud and credential phishing.

Set one rule and repeat it: if anyone emails to change bank details or ask for an urgent payment, verify it by phone using a number you already have on file, never the number in the email. Make reporting mistakes easy and blame-free, because a suspicious email reported in five minutes is worth more than a perfect record nobody talks about. A five-minute reminder at a team meeting each month, using real examples with the names removed, does more than a lengthy annual training session.

The Ten Points and How to Make Them Stick

1. Patch operating systems, browsers and applications.
2. Update firmware on routers, firewalls and storage.
3. Confirm MFA is active on email, banking and admin accounts.
4. Check sign-in logs for anything unusual.
5. Review who has access and remove what is no longer needed.
6. Verify backups ran and restore a test file.
7. Confirm encryption, screen locks and endpoint protection on every device.
8. Review admin rights and remote access rules.
9. Reinforce the payment-change phone rule with the team.
10. Write down what you found and what you fixed.

Ninety minutes on the first Tuesday of the month is enough for a business of ten to fifty people. Assign one owner, keep a running document with dates and initials, and carry unfinished items into the next month rather than letting them disappear.

If an item keeps getting skipped, you have three honest options: fix it properly, hand it to a managed IT provider, or accept the risk with your eyes open. What you should not do is assume it is handled. And if your contracts, insurance or sector rules demand specific security controls, confirm the details with a qualified professional rather than a checklist alone.

Photo: Tumisu / Pixabay