Cybersecurity Checklist for Small Businesses

A good cybersecurity checklist for a small business covers six areas, in this order: protect your accounts (multi-factor authentication and unique passwords), keep devices and software updated, back up data and test the restore, limit who can access what, train people to spot phishing, and write down what to do when something goes wrong. Do those well and you have dealt with the majority of the realistic risks a small Irish business faces. The rest of this article turns each area into concrete actions you can tick off.

You do not need a large budget to start. You need a clear owner, a list of what you have, and a habit of reviewing it. The checklist below is deliberately practical and vendor-neutral.

Step zero: know what you have

You cannot protect what you cannot list. Spend an hour writing down four things: the devices staff use (laptops, phones, tablets), the online services you depend on (email, accounting, CRM, file storage, website hosting), where customer and employee personal data lives, and who has administrator rights on each system. A shared spreadsheet is fine. This inventory becomes the backbone of everything else, including any data protection obligations you have.

1. Accounts and passwords

• Enable multi-factor authentication (MFA) on email, banking, accounting, cloud storage, your domain registrar and your website admin panel. Start with email.
• Use a password manager so every account has a long, unique password. See our guide to password policy best practice.
• Separate admin accounts from everyday accounts. The person who reads email all day should not be signed in as a global administrator.
• Remove old accounts promptly when someone leaves, including shared logins they knew.

2. Devices and software

• Turn on automatic updates for operating systems, browsers and business applications.
• Replace anything that no longer receives security updates from its vendor. Unsupported software is a standing invitation.
• Enable full-disk encryption on laptops and phones so a lost device does not become a data breach. The basics are explained in encryption at rest vs in transit.
• Use a screen lock with a short timeout and a PIN or biometric on every device, including personal phones used for work.
• Run reputable endpoint protection and keep it switched on.

3. Backups you have actually restored

Backups are your recovery plan for hardware failure, accidental deletion and ransomware. A common rule of thumb is the 3-2-1 approach: three copies of important data, on two different types of storage, with one copy offline or otherwise kept out of reach of your normal accounts. The part most businesses skip is the test. Once a quarter, restore a few real files and one complete system to confirm the backup works and you know how long it takes. A backup you have never restored is an assumption, not a control.

4. Network and email

• Change default passwords on routers, printers and any internet-connected device.
• Keep the office Wi-Fi on modern encryption with a strong passphrase, and put guests on a separate network.
• Do not expose remote desktop or admin interfaces directly to the internet. Use a VPN or a managed remote access tool with MFA.
• Ask whoever runs your domain and email to confirm SPF, DKIM and DMARC are set up, which makes it harder for criminals to send email pretending to be you.

5. People

Most incidents start with a person making a reasonable-looking decision: clicking a link, approving a payment, sharing a file. Short, regular, practical training works better than an annual slideshow. Cover how to spot phishing (see how to spot and respond to phishing), why payment-detail changes must be verified by phone using a number you already hold, and how to report a mistake quickly without fear of blame. Fast reporting is worth more than perfect behaviour.

6. Access and data

Apply least privilege: give people access to what they need for their job, no more. Review shared folders and cloud sharing links, because old "anyone with the link" links tend to linger. Keep personal data you no longer need out of your systems; data you do not hold cannot be stolen. If you handle personal data of individuals in the EU, our overview of GDPR and security explains how security fits into your obligations.

7. A one-page incident plan

Write down, before you need it: who decides what, who to call (your IT provider, your bank, your insurer if you have one), how to isolate a device, and when and how a personal data breach would be assessed and reported. Under GDPR, certain breaches must be notified to the Data Protection Commission within a short, defined window, so knowing the process in advance matters. This is general information and not legal advice.

A simple priority table

Priority	Action	Typical effort
Do first	MFA on email and finance accounts	An afternoon
Do first	Automatic updates everywhere	A few hours
Do first	Tested, offline-capable backups	A day, then quarterly checks
Next	Password manager for all staff	A week to roll out
Next	Disk encryption on laptops and phones	Hours per device group
Then	Staff training and phishing reporting routine	Short sessions, ongoing
Then	Incident plan and access review	A half day, reviewed quarterly

Effort figures here are rules of thumb. They vary with the size of your team and how many systems you run.

Make it a routine, not a project

Security fades when it is treated as a one-off project. Pick a recurring slot, for example the first Monday of each quarter, and run the same short review: who has joined or left, which accounts have admin rights, whether updates are applying, whether the last backup restore worked, and whether any supplier has changed how they handle your data. Record the outcome in a single document with a date and a name against each item. That record is useful if a customer, insurer or auditor ever asks how you manage risk, and it makes it obvious when something has slipped. Keep the review short enough that it actually happens: thirty to sixty minutes for a small team is a reasonable rule of thumb.

Common mistakes

• Buying a tool before fixing the basics. A new product does not compensate for missing MFA or untested backups.
• Treating security as an IT-only issue. Finance, HR and management all make decisions that attackers exploit.
• Sharing logins. A shared password cannot tell you who did what and is never removed when staff leave.
• Keeping backups on the same network, signed in with the same admin account. Ransomware encrypts what it can reach.
• Never reviewing. Staff change, systems change, and a checklist done once in 2024 does not describe today.
• Ignoring your suppliers. Your accountant, hosting provider and software vendors hold your data too. Ask how they protect it.

Where official guidance helps

Ireland's National Cyber Security Centre publishes guidance aimed at organisations of all sizes, and the Data Protection Commission explains the data protection side. Use them as your reference points, and treat any single article, including this one, as a starting point rather than a full assessment of your situation.

Next steps

Print the checklist, assign an owner to each section, and put a quarterly review in the diary. If you would rather have an experienced second pair of eyes on your setup, our cybersecurity solutions cover encryption, authentication, audits and threat monitoring, and we are happy to talk through where to start.