Basic cybersecurity checklist small businesses actually need

Start with what you can actually control this week

Cybersecurity for a small office does not have to mean a full audit or expensive software on day one. It means fixing the handful of things that create most real-world risk: weak credentials, unmanaged access, unpatched devices, and no backup plan if something does go wrong.

The checklist

• Change every default password on routers, switches, NVRs, and cameras before go-live
• Remove access for former employees and vendors the same week they leave
• Keep one list of who has admin access to what, and review it quarterly
• Turn on automatic updates for firewalls, routers, and server operating systems where possible
• Separate CCTV, office, and guest Wi-Fi onto different network segments
• Confirm backups exist, run on schedule, and have actually been restored at least once
• Enable two-factor authentication on email and any remote-access tool that supports it
• Keep a simple incident contact list: who to call first if something looks wrong

Where small businesses usually go wrong

Most incidents are not sophisticated attacks. They are the result of a router still running its factory login, a remote-access tool left open after a one-time job, or a departing employee's account that was quietly forgotten. None of these need a security budget to fix, only a habit of closing the loop.

What good baseline security looks like

A small business does not need enterprise-grade tooling to be reasonably secure. It needs consistent basics: unique credentials everywhere, access reviewed regularly, patching that actually happens, network segmentation between CCTV/office/guest traffic, and backups that have been tested, not just scheduled.

Related content

• Network audit checklist
• VLAN basics for CCTV and office networks
• Small business server backup checklist
• Password and access hygiene for small business IT