Most small businesses do not get hurt by sophisticated attacks. They get hurt by a reused password, an email that looked real, a laptop that missed its updates, or a former employee who still has a login. The fixes for those are not glamorous, and most of them cost little or nothing. They just have to actually get done.
We covered the thinking behind this in cybersecurity for small and mid-size businesses. This piece is the practical version: a checklist you can walk through with your team this week, in plain English, with no jargon required.
1. Turn on multi-factor authentication everywhere
Multi-factor authentication, often called MFA or two-step verification, means a password alone is not enough to get in. Someone also needs a code from a phone app, a security key, or a prompt they approve.
Start with the accounts that would hurt most to lose: email, banking, payroll, your website and domain registrar, your accounting software, and any social media accounts that speak for the business. Email comes first, because whoever controls your inbox can reset the password on almost everything else.
Prefer an authenticator app or a security key over text message codes where the service allows it.
2. Use a password manager
Nobody can remember a unique, strong password for every account, so people reuse them. When one site leaks, every account sharing that password is exposed.
A password manager generates and remembers a different password for each account. Most business versions also let you share logins with the team securely, so nobody is passing passwords around in a text thread or a spreadsheet. Pick one, put the whole team on it, and make it the only place company passwords live.
3. Back up, and prove the backup works
A backup you have never restored from is a hope, not a plan. Make sure the data you cannot run without, customer records, financials, contracts, the website, is backed up automatically. Keep at least one copy somewhere separate from your main systems, so the same problem cannot take out both.
Then test it. Pick a file or a folder a few times a year and actually restore it. The day you need a backup is the worst day to learn it was not running.
4. Keep everything updated
Updates fix the security holes attackers already know about. Turn on automatic updates for computers, phones, browsers and the software your team uses every day. Do not forget the things nobody thinks of as computers: the office router, the Wi-Fi access points, the printer, the plugins on your website.
If a device is too old to receive updates anymore, plan to replace it.
5. Teach the team to slow down on email
Phishing remains one of the easiest ways in. The email looks like it came from a vendor, a bank, a delivery company, or the boss, and it asks someone to click, log in, pay an invoice, or change bank details.
A few habits cover most of it:
- Be suspicious of urgency. “Today,” “immediately,” and “before end of day” are pressure, not information.
- Check the actual sender address, not just the display name.
- Never change payment details based on an email alone. Call the person at a number you already have.
- Make it easy and blame-free to report something odd. The employee who asks “is this real?” is doing their job.
Short, regular reminders work better than one long training session a year.
6. Remove access the day someone leaves
When an employee or contractor leaves, their access should leave with them, the same day. Keep a simple list of every system each person can get into, so offboarding is a checklist rather than a memory test. Disable their accounts, change any shared passwords they knew, recover company devices, and move ownership of their files and email to someone who is staying.
While you are at it, review access for the people who are still there. People collect permissions as their roles change and rarely give any back.
7. Know which vendors can get in
Your IT provider, your website developer, your bookkeeper, your software vendors: many of them hold logins or remote access to your systems. Make a list. Confirm each one still needs that access, that it belongs to a named account rather than a shared one, and that it is protected with multi-factor authentication. When a relationship ends, remove the access just as you would for a departing employee.
8. Write down what to do in an incident
Something will go wrong eventually, and the first hour matters. Write a one-page plan, short enough that a stressed person can follow it:
- Who to call first, inside the business and outside it, with phone numbers written on paper as well as stored in a system that might be down.
- How to disconnect an affected device from the network without wiping it.
- How to restore from backup, and who knows how.
- Who speaks to customers, and what you are required to tell them if their data is involved.
Then change passwords from a clean device, turn on anything that was missing, and figure out how it happened so it does not happen twice.
9. Put a name next to it
The most common failure is not a missing tool. It is that nobody owns security, so everyone assumes someone else is handling it. Give one person responsibility for this list, even if they rely on outside help, and put a recurring date on the calendar to walk through it again.
Where Wave helps
Our cybersecurity and data protection work follows three phases: we assess your exposure, put protection in place, and monitor over time. That covers security audits, access and identity controls, data protection, threat monitoring, backup and recovery, and security training for your staff, since people are the most common gap. We set up monitoring and response appropriate to your risk and budget, and if something has already happened, we help you respond, recover and harden against the next one.
Start with the checklist. If you would rather have someone walk through it with you, see our cybersecurity and data protection page or book a call with a senior member of the team.
