You don’t need a security team to close the gaps attackers use most. This jargon-free checklist covers the protections that matter as your company grows.
Most security incidents at small and mid-sized companies don’t involve clever hackers. They start with a reused password, a convincing phishing email, an unpatched plugin, or a former employee whose account was never switched off.
That’s good news, because those gaps are fixable without a large budget or a dedicated security team. This checklist covers the basics in the order we’d tackle them, written for founders and managers rather than specialists.
1. Accounts and passwords
Stolen and guessed passwords are among the most common ways attackers get in.
- Turn on multi-factor authentication (MFA) everywhere, starting with email, cloud storage, banking, your domain registrar and admin accounts
- Prefer authenticator apps or passkeys over SMS codes where you can
- Give everyone a company password manager so they can use long, unique passwords without memorising them
- Use single sign-on (SSO) through Google Workspace or Microsoft 365 for business tools where possible
- Keep separate admin accounts for admin tasks, and limit how many people have them
2. Joiners, movers and leavers
Access tends to pile up as people change roles, and it’s rarely removed when they leave.
- Keep a simple list of every system each person has access to
- Use an offboarding checklist: disable accounts on the person's last day, transfer file ownership, revoke shared passwords, recover devices
- Review access to key systems every quarter and remove what isn't needed
- Give people the minimum access they need to do their job ("least privilege")
3. Email and phishing
- Set up SPF, DKIM and DMARC on your domain. These DNS records stop attackers sending email that looks like it comes from you, and major mailbox providers now expect them from bulk senders
- Move DMARC from "monitor" to "quarantine" or "reject" once you've confirmed legitimate senders pass
- Turn on your email provider's built-in phishing and malware protection
- Run short, regular phishing awareness sessions, not just a yearly slideshow
- Make it easy and blame-free to report a suspicious email
Protect payments with a call-back rule: any request to change bank details or make an urgent payment must be confirmed by phone, using a number you already have, not one in the email. This single rule stops a large share of invoice fraud.
4. Laptops and phones
- Turn on automatic operating system and browser updates
- Enable full-disk encryption (FileVault on Mac, BitLocker on Windows)
- Require a screen lock and a short auto-lock time
- Use device management (MDM) once you pass roughly 15–20 people, so you can enforce settings and wipe lost devices
- Keep built-in antivirus and firewall turned on
5. Software, websites and cloud
- Keep your website CMS, plugins, themes and libraries updated, and remove ones you don't use
- Apply critical security patches within days, not months
- Check cloud storage for files or folders shared publicly by mistake
- Never store passwords or API keys in code or shared documents; use a secrets manager
- Put your website behind a web application firewall and CDN
- Use automated dependency scanning in your code repositories
6. Backups
Backups are what turn a ransomware attack from a catastrophe into a bad week.
- Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one off-site
- Keep at least one backup that can't be changed or deleted from your main systems (immutable or offline)
- Back up SaaS data too; Google Workspace and Microsoft 365 don't guarantee recovery of everything you delete
- Test a restore at least twice a year. A backup you've never restored is a hope, not a plan
7. Data you hold about people
- Know what customer and employee data you hold, where it lives and who can see it
- Delete data you no longer need
- Encrypt sensitive data in storage and in transit
- Check what your obligations are under GDPR, India's DPDP Act or other privacy laws that apply to your customers
8. Suppliers and tools
- Keep a list of the software and service providers that hold your data
- For critical suppliers, ask about their security: certifications such as ISO 27001 or SOC 2, MFA, backups and breach notification
- Sign data processing agreements where personal data is involved
- Review which third-party apps are connected to your Google or Microsoft accounts and remove unused ones
9. Logging and monitoring
- Turn on audit logs in your email, cloud and admin tools
- Set alerts for suspicious sign-ins, new admin accounts and mass downloads
- Monitor your website and key services for downtime
10. Have a plan for a bad day
When something goes wrong, the first hour matters. Write a one-page incident plan covering:
- Who's in charge, and how to reach them out of hours
- Who to call for technical help, legal advice and your insurer
- How to isolate an affected device or account
- Your notification deadlines (for example, GDPR requires notifying the regulator within 72 hours of becoming aware of certain breaches)
- How you'll communicate with staff and customers
Walk through it once a year with a simple “what would we do if…” exercise.
Where to start
If you only do five things this month, do these:
- MFA on email and every admin account
- A company password manager
- Automatic updates on all devices and your website
- Tested, off-site backups
- An offboarding checklist that’s actually used
As you grow, a recognised framework such as the UK’s Cyber Essentials, ISO 27001 or SOC 2 can help structure the next steps, and is increasingly something larger customers will ask about.
Want a second pair of eyes on your setup? We run practical security reviews of websites, apps and cloud environments. Get in touch.
Need a hand with this?
Our team designs, builds and secures websites, apps and AI automations for growing businesses.