Who this checklist is for
This small business security checklist is for owners and office managers who run the computers, phones and logins themselves, without an IT team. It works the same for a shop, a clinic, a factory, an agency or a distributor. Small businesses rarely get hacked by a clever attack. It is usually a fake message asking for an urgent payment, a password used everywhere, or a laptop that dies with the only copy of the files.
Use it this week, and come back to it when a strange payment request arrives, when you buy a new laptop, or when someone new joins. The first items take minutes. The later ones take an afternoon, and they are the ones that save you when something does go wrong.
The 15 things, and why each one matters
2-step email login
Turn on 2-step login for every work email in Gmail or Outlook. A stolen password alone then cannot open the mailbox where every reset link lands.
WhatsApp PIN
Set a two-step PIN on the business WhatsApp number in its settings. It stops someone who tricks you into sharing a code from taking over the number your customers message.
Call before paying
When a supplier sends new bank details, call them on a number you already have, not the one in the email. Changed bank details are the most common way small businesses lose money.
Fake boss messages
A message from the owner or a partner asking for an urgent transfer or gift cards gets a phone call before anyone pays. Agree this rule with the team in advance so nobody feels awkward checking.
No login links
Open your bank, tax portal or payment gateway by typing the address yourself or from a saved bookmark. Login links in emails and messages are where fake pages hide.
Screen lock
Set every computer and phone to lock after five idle minutes, with a PIN or password. An open screen at the counter is an open door to your accounts.
Auto updates on
Turn on automatic updates for every laptop, phone and the office router. Most attacks use holes that an update already fixed.
Bank alerts
Set SMS and email alerts for every debit on business accounts, sent to the owner. You find a wrong payment the same day, while the bank can still act on it.
Guest Wi-Fi
Give customers and visitors a separate guest Wi-Fi network. Their phones then never share a network with your billing computer.
Password manager
Keep every business login in one password manager instead of a notebook or a shared sheet. It also makes long, different passwords easy.
No reused passwords
Use a different password for the bank, email and every tool. When one website leaks, the same password cannot open the rest.
Backup codes
Print the backup codes for 2-step login and keep them locked away. If the phone is lost, they are how you get back in.
Offline backup
Copy important files every week to a drive that stays unplugged, or to a cloud backup with older versions kept. If files get locked or deleted, you still have last week's copy.
Fewer admins
Only the owner or one trusted person can install software on office computers. Staff accounts without admin rights stop most harmful downloads.
Login owner list
Keep one list of every tool the business uses and who has admin access to each. When someone leaves or a login is stolen, you know exactly what to change.
Questions about small business security
How do small businesses usually get hacked?
What should a small business do first for security?
Can security checks be automated?
How many of your logins live in one person's head?
Book a digital audit. Tell us which tools, logins and payment steps your team uses, and we will map where the risks are and what can be checked automatically.
Part of our Business Process Automation hub. Start with our business automation services.