I don't know where to start with cybersecurity: a 10-step checklist for small business
⏱ In about 12 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
Start with the basics, because they stop most attacks. The Australian Cyber Security Centre (ACSC) says strong multi-factor authentication (MFA), strong and unique passwords, updated software, alertness to phishing, and regular backups "can prevent the majority of the cyber incidents reported" to it. (ACSC Annual Cyber Threat Report 2024–25)
Work through the 10 steps below. Most are free. The two tools that help most are a business password manager and, if you want central control of your devices, business security software.
Why this matters for a small business
- You're not too small to be a target. The UK National Cyber Security Centre (NCSC) says small businesses "are just as likely to experience online crime as larger ones." (NCSC)
- It's expensive when it goes wrong. The ACSC reports the average self-reported cost of cybercrime per report for a small business was A$56,600 in 2024–25 (A$97,200 for medium businesses). These are averages across reports, not a prediction for any one business. (ACSC Annual Cyber Threat Report 2024–25)
- Email is the front door. The top two cybercrimes businesses reported to the ACSC were email compromise (19%) and business email compromise fraud with financial loss (15%). The same report says phishing was recorded in 60% of the incidents reported to the ACSC in 2024–25. (ACSC)
The good news: the fixes are mostly habits and settings, not big projects. The NCSC says many of its recommendations "can be completed in as little as 5 minutes". (NCSC)
The 10-step checklist
The time guides are rough, for a team of about 5–20 people. Print it, give each item an owner, and tick it off.
1. Turn on MFA for your most important accounts (about 1 hour)
The ACSC calls MFA "one of the most effective ways to protect business accounts" and says to start with "email, banking, cloud storage, accounting software and social media." Choose passkeys, security keys or authenticator apps over SMS codes where you can; the ACSC describes SMS and email codes as "the least secure option". (ACSC) Full walkthrough: set up two-factor authentication.
2. Use unique passwords, stored in a password manager (2 hours, then a week of rollout)
The ACSC says "Weak or reused passwords are a common cause of cyber security incidents in small businesses" and tells businesses to "use a password manager to generate and securely store passwords." Where MFA can't be used, passwords should be "at least 15 characters long." (ACSC) See our password reuse guide.
3. Turn on automatic updates everywhere (30 minutes)
The ACSC recommends "enabling automatic updates wherever possible", and says devices or software that no longer receive updates "can leave your business exposed." (ACSC, Protecting devices, systems and networks) Include phones, routers and your website's plugins.
4. Back up, and test that you can restore (1–2 hours to set up)
The ACSC says "Regular backups that are tested and stored separately from your main systems are one of the most effective ways to reduce the impact of a ransomware attack." (ACSC, Common cyber threats) Write down what's backed up, where, who checks it, and how often you test a restore. Don't forget data that lives in email and cloud accounts.
5. Limit admin rights (30 minutes)
Follow the "principle of least privilege": staff get only the access they need, and only those who need it get administrator access. The ACSC also recommends "separate administrator accounts for staff with administrative privileges." (ACSC, Restrict and monitor access)
6. Teach the team to spot phishing, and to report it (30 minutes, then regularly)
Make it easy and blame-free to report a suspicious email. The ACSC recommends ongoing training "rather than a one-time activity" on phishing, ransomware and social engineering. (ACSC, Educate staff) If someone does click, follow our what to do after clicking a phishing link guide.
7. Verify every change to payment details (15 minutes to agree the rule)
Business email compromise often means a fake invoice or a "new bank account" email. The ACSC says to "verify unusual requests using a trusted communication channel, such as a known phone number rather than contact details provided in the email." (ACSC) Make it a written rule: no bank-detail change without a phone call to a known number.
8. Lock and protect every device (30 minutes)
At a minimum, the ACSC says to protect devices "with a password or biometric authentication" and set them "to automatically lock after a short period of inactivity." Use the built-in antivirus most modern Microsoft and Apple computers include, or business security software, and set it to scan regularly. (ACSC) More detail: do small businesses need antivirus?
9. Remove access the day someone leaves (15 minutes per leaver)
The ACSC says to "change login details when staff leave or change roles" and "remove access promptly when staff leave." (ACSC) Our offboarding guide has a checklist.
10. Write a one-page "what we do if…" plan (1 hour)
Who staff tell, who you call (IT provider, bank), how you'll keep working, and where to report. The ACSC says a copy "should be available offline in case systems are inaccessible." (ACSC, People, training and incident readiness)
Where to report an incident: Australia: ACSC ReportCyber. UK: see the NCSC's reporting guidance. US: CISA's small business guidance lists how to contact CISA. Canada: Canadian Centre for Cyber Security.
The cost of doing nothing vs the cost of doing this
| Factor | Doing nothing | Working through this list |
|---|---|---|
| Money | ACSC average self-reported cost per small-business cybercrime report: A$56,600 (2024–25). An average, not a forecast. | Most steps are free. Paid tools are optional subscriptions (see below). |
| Time | Days of recovery: locked accounts, angry customers, calls to the bank. | Roughly a day of work spread over a couple of weeks, then a short monthly check. |
| Control | You don't know who can access what. | You know, and you can change it in minutes. |
Quick pick
Quick pick: tools that make this checklist easier (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
- Best for most small teams (steps 1, 2 and 9): a business password manager such as 1Password. Teams Starter Pack listed at US$24.95/month billed annually for 10 members, with password health reporting and account recovery. 14-day free trial. → See our password manager guide
If you're on a tight budget: Proton Pass. Pass Essentials listed at US$1.99 per user/month billed yearly (minimum 3 users) at a discounted rate, with a built-in 2FA authenticator. → See our password manager guide- If you want central control of device security (step 8): Bitdefender GravityZone Small Business Security. Bitdefender says it covers 1 to 100 devices (laptops, desktops, file servers), managed from one console, with ransomware mitigation and anti-phishing. Pricing depends on device count, so check the vendor page. → See our cybersecurity guide
Compare password managers in our small team guide or see all quick picks.
Honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
What's the single most important step?
MFA on your email account. Email is where password resets land, so whoever controls it can usually reach everything else.
How often should we review this?
A quick monthly check (updates applied, backups working, leavers removed) and a fuller review once a year.
Do we need an IT provider for this?
Not for the basics. Most steps are settings an owner can switch on. Get help for servers, networks or anything you're unsure about.
We're in the UK/US/Canada. Does this still apply?
Yes. The basics are the same across national agencies. The Canadian Centre for Cyber Security, for example, also starts with patching, MFA, backups and security software. (CCCS)
Should we pay the ransom if we're hit by ransomware?
The ACSC says "do not pay the ransom", because paying "does not guarantee that your files will be recovered." Get IT help and report it. (ACSC)
Related guides
- Start here: free 5-step security checklist · Cybersecurity tools
- My staff reuse passwords: how to fix it this week
- We've never turned on two-step login
- A staff member clicked a dodgy email link · My team works from cafés and home Wi-Fi
Sources
Government bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Annual Cyber Threat Report 2024–25
- Australian Cyber Security Centre, Small business cyber security handbook: Securing accounts and identities · Protecting devices, systems and networks · Common cyber threats · Restrict and monitor access · Educate staff · People, training and incident readiness
- Australian Cyber Security Centre: Submit a report
- UK National Cyber Security Centre: Small organisations guide to cyber security · Phishing scams: how to spot and report them
- US Cybersecurity and Infrastructure Security Agency: Cyber guidance for small businesses
- Canadian Centre for Cyber Security: Top measures to enhance cyber security for small and medium organizations
- Vendor pages (checked 18 Oct 2026): 1Password business pricing · Proton Pass for business · Bitdefender GravityZone Small Business Security
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.