Webbit
Small Business Cybersecurity Checklist for 2027
A plain-language checklist for small businesses: accounts, devices, email, backups, access, your website and your people. Most items take an afternoon.
You don't need a security team to get the basics right. You need a short list, an owner for each item and a date. This checklist covers the controls that stop the most common problems for a business with five to a few hundred people. Work through it once, then repeat it every quarter.
Accounts and passwords
- Turn on multi-factor sign-in for email, banking, your cloud storage and your website admin. Use an authenticator app or a passkey over text messages where you can.
- Give everyone a password manager and ban reused passwords.
- Remove accounts for people who have left, and for agencies and tools you no longer use.
- Stop sharing logins. If a tool forces one shared account, put the password in the manager and log who uses it.
- Keep two people able to recover the main business accounts, so one person's phone isn't a single point of failure.
Devices and updates
- Turn on automatic updates for computers, phones, browsers and routers.
- Encrypt laptops and phones, and enable remote wipe.
- Remove software nobody uses, including old browser extensions.
- Keep a list of every device that touches company data, including personal phones.
Email and phishing
- Set up SPF, DKIM and DMARC for your domain so criminals can't easily send mail as you.
- Agree a rule that nobody changes bank details or pays an urgent invoice from an email alone. Confirm by calling a number you already hold.
- Show staff what a convincing fake looks like, using real examples, once a year at minimum.
- Give people an easy way to report a suspicious message, and thank them when they do.
Backups
- Follow a simple pattern: three copies, on two kinds of storage, with one kept offline or immutable.
- Back up cloud tools too. Email, documents and your CRM aren't automatically backed up by the provider the way many people assume.
- Test a restore at least once a year, and time it.
- Write down who restores what, and in what order.
Access and permissions
- Give people only the access their job needs. Finance files don't need to be open to the whole company.
- Keep admin rights for admin tasks. Nobody should read email from an administrator account.
- Review who has access to your key systems every quarter.
Your website and online tools
- Update your website platform, themes and plugins promptly, and delete the ones you don't use.
- Use HTTPS everywhere, and keep a current backup of the site.
- Check what your contact forms, chat widgets and tracking scripts send, and to whom.
People and planning
- Write a one-page plan: who to call, what to switch off first, who talks to customers.
- Know where your customer data lives, and who can see it.
If you only have one afternoon. Turn on multi-factor sign-in for email and banking, install a password manager, and test one backup restore. Those three steps close the doors attackers use most often.
How to track it
| Check | Owner | Last done | Next due |
|---|
| Multi-factor sign-in on key accounts | Name | Date | Date |
| Leavers and unused accounts removed | Name | Date | Date |
| Updates applied to devices and website | Name | Date | Date |
| Backup restore tested | Name | Date | Date |
| Supplier access reviewed | Name | Date | Date |
Once the basics are in place, the next steps are a deeper look at your exposure and your suppliers. Our 2027 trends guide shows where attackers are heading, and the ransomware guide explains why tested backups matter so much.
A four-week plan
| Week | Focus | Done when |
|---|
| 1 | Accounts | Multi-factor sign-in is on for email, banking, cloud and website admin, and everyone has a password manager |
| 2 | Devices and email | Updates are automatic, SPF, DKIM and DMARC are set, and staff know how to report a suspicious message |
| 3 | Backups and access | A restore has been tested, leavers are removed and admin rights are reviewed |
| 4 | People and plan | Staff have had a short briefing, a one-page response plan exists and the checklist is dated |
Settings to check in your cloud tools
Most small businesses live in Microsoft 365 or Google Workspace. Both include security settings that are often left at their defaults.
- Require multi-factor sign-in for every user, not only administrators.
- Block old sign-in methods that can't use a second factor.
- Turn on alerts for suspicious sign-ins and for new forwarding rules, a favourite trick for hiding stolen mail.
- Review external sharing and limit who can share files with people outside the company.
- Check which connected apps can read your mailbox and drive, and remove any you don't recognise.
Mistakes that undo good work
- Enabling multi-factor sign-in for some accounts and leaving old, shared or service accounts without it.
- Keeping the only backup on the same network or the same cloud account as the original, so a single takeover removes both.
- Letting a former employee's or agency's access sit for months.
- Writing a response plan and storing it only on the system that would be down.
- Doing everything once and never repeating it.
What good looks like after 90 days
- Everyone signs in with a second factor, and nobody reuses a password.
- You can list your systems, suppliers and the data each holds on one page.
- A restore has been timed, and the number is written down.
- Staff report suspicious messages and aren't embarrassed to ask.
- Someone owns the checklist and reviews it every quarter.
Want a second pair of eyes?
A checklist tells you what to look at. It can't tell you what you've missed. Webbit's cybersecurity assessment reviews your websites, cloud accounts and connected tools against these checks and more, then gives you a short, ordered fix list in plain language. Book a free consultation and we'll suggest where to start.
Frequently asked questions
What is the single most effective cybersecurity step for a small business?
Multi-factor sign-in on email, banking and cloud accounts. Stolen passwords are one of the most common ways in, and a second factor stops most of those attempts.
How much time does this checklist take?
Most items take minutes to a few hours. A team of ten can usually complete the whole list in a few weeks alongside normal work.
Do we need cyber insurance?
Insurance can help with costs after an incident, and insurers often ask whether you have multi-factor sign-in and tested backups. It supports good security. It doesn't replace it.
How often should we repeat the checklist?
Quarterly for access and backups, and after any big change such as a new supplier or a new system.
Home · Blog · Book a Free Consultation