Basic Cybersecurity Checklist for Small Business

v5 – Last updated 8/28/25

“Stronger Cybersecurity, Stronger Business.” – Matt Logan, Founder

In today’s connected world, cybersecurity is a critical part of protecting your business—not just your computers, but your reputation, customer trust, and ongoing operations. This self‑assessment is designed to highlight potential cybersecurity gaps in small and mid‑sized businesses. By answering these simple questions, you will gain a clearer picture of your current security status and discover practical steps you can take to reduce operational risk. Use this checklist annually to help safeguard your business and stay ahead of evolving threats.

Answer “Yes” or “No” to these 20 questions to see how well your business is protected.

🔐 Account & Identity Security

[ ] Do you require multi‑factor authentication (MFA) for employee logins?
[ ] Do employees receive regular security awareness training to recognize phishing attacks?
[ ] Do you monitor for signs of unauthorized logins or data breaches across accounts?

💻 Endpoint & Device Protection

[ ] Are you using Endpoint Detection & Response (EDR) instead of only traditional antivirus?
[ ] Are all security tools centrally managed so you can see issues across every device?
[ ] Do you receive real‑time alerts when suspicious activity occurs?
[ ] Do you get notified if antivirus/EDR is disabled or outdated on any device?
[ ] Are all computers enrolled in a management system for consistent updates and security?
[ ] Do computers receive automatic patches and updates?

🖥️ Servers & Networks

[ ] Are your servers continuously monitored for security and performance?
[ ] Is remote access centralized, secured, and logged for accountability?
[ ] Do you use web/DNS filtering to block malicious websites?
[ ] Is your guest Wi‑Fi segmented from business systems?
[ ] Are you alerted when new or unknown devices connect to your network?

☁️ Cloud & SaaS Security

[ ] Do you actively monitor Microsoft 365, SharePoint, or other SaaS apps for unauthorized access?
[ ] Do you back up email and cloud storage data against deletion or ransomware?

💾 Backups & Continuity

[ ] Are servers backed up off‑site with multiple days of recovery points?
[ ] Are executive and process‑critical computers backed up regularly?
[ ] Do you have an email continuity plan for outages?

📧 Email Security

[ ] Do you use advanced email filters (beyond basic spam filtering) to help block phishing, ID theft and malware?

📋Bonus Question

[ ] Is your organization’s IT program aligned with recognized external standards or frameworks such as CIS Controls, NIST, ISO, etc.?

📊 Your Cybersecurity Risk Score

(Yes = 1, No = 0)
🚨 0–7 points = High Risk – Serious gaps— attackers would find this business an easy target.
⚠️ 8–14 points = Moderate Risk – Some protections in place, but key vulnerabilities remain.
✅ 15–20 points = Good Coverage – Strong foundation— review annually to stay protected.