A small-business network is more than the internet connection in the corner. It connects staff computers, payment terminals, cameras, phones, printers, cloud services and the accounts that keep the day moving. When nobody owns the setup, a forgotten administrator password or an old device can become a bigger interruption than it should be.
This network security best practices checklist is designed for owners and office managers who need a clear operating baseline, not a shopping list of expensive tools. Work through it with the person who manages your technology. Mark each item as in place, partial, missing or unknown. “Unknown” is useful because it tells you exactly what needs checking next.
1. Name an owner and map what connects
Every business needs one person responsible for keeping the network record current. That person does not need to be the technical expert. Their job is to know where the router, firewall, Wi-Fi access points, switches, cameras, POS terminals, printers and business computers are, who supports them, and how to reach that support when something changes.
Make a plain inventory that includes device name, location, purpose, administrator, support contact and whether the equipment is still supported by its vendor. The Federal Trade Commission’s small-business guidance specifically includes laptops, smartphones, point-of-sale devices, applications and business data in this kind of inventory. That list gives you a starting point for access reviews, replacements and recovery.
2. Secure the router, firewall and administrator accounts
The device at the network edge deserves deliberate attention. Change factory usernames and passwords, give each administrator a separate account where the equipment allows it, and keep the recovery details somewhere the business can reach. Do not leave equipment tied to a former employee’s personal email address or phone.
Turn off remote management unless there is a business reason to use it and it is configured by someone accountable for the security. Keep the device firmware current, record the make and model, and confirm that someone receives alerts. The FTC recommends changing default router credentials, turning off remote management and logging out of the administrator account after setup. A current, supported firewall is also part of the baseline described in NIST’s small-business security fundamentals.
3. Separate Wi-Fi by the job it needs to do
Guest Wi-Fi should not share the same network as business computers, payment equipment, cameras or network administration tools. Personal phones and visitor devices are convenient, but they do not need the same access as the systems that process transactions or store business information. Create a separate guest network and keep its password and support instructions separate from the staff network.
Use WPA2 or WPA3 encryption on wireless networks, avoid old WEP security, and use a strong unique Wi-Fi password. Decide which devices belong on a staff network, a guest network and, where appropriate, a dedicated network for cameras or payment equipment. NIST specifically advises separating customer internet access from the business network, while the FTC advises limiting the primary network to business-owned, operated or managed devices.
4. Limit access before a problem arrives
Use the least access that lets a person do their job. A cashier may need the POS terminal but not the router. A contractor may need temporary remote access but not an ongoing administrator account. Review access whenever staff, vendors, locations or software change, then remove accounts and remote tools that are no longer needed.
Multi-factor authentication matters here because a password alone should not unlock network administration, email, cloud storage or remote support. The FTC recommends it for people who access networks and devices. Keep administrator accounts separate from routine email and web browsing, and do not share one login among several people. Individual accounts make it possible to remove access without disrupting the rest of the team.
5. Keep every connected device supported and updated
Network security is affected by more than laptops. Check routers, switches, access points, printers, cameras, POS systems and phones, as well as the computers that manage them. Turn on automatic updates where that is safe, schedule maintenance windows for equipment that cannot update automatically and keep a list of exceptions with a named owner.
Do not treat old equipment as harmless because it still works. When a vendor ends support, the business loses future fixes for newly discovered problems. Build a replacement plan, especially for equipment that handles payments, remote access or business data. For help organizing equipment, access and a practical support plan, Matrix’s IT and networking services can help turn an ad hoc setup into a manageable one.
6. Treat remote work and vendors as part of the network
Remote access is useful when it is intentional. List every way staff and vendors can reach business systems from outside the office, including remote-support tools, cloud administration portals, VPNs, hosted phone systems and cameras. For each one, document the account owner, the users who need access and how access is removed. A remote tool left behind after a project is not a convenience, it is an unanswered security question.
Ask remote workers to keep their home router updated, use a supported device and avoid public Wi-Fi for sensitive work. When staff must work away from a trusted network, use an approved secure connection and multi-factor authentication. The FTC notes that remote devices should meet business security requirements before connecting, and recommends WPA2 or WPA3 encryption for home routers used by employees and vendors.
7. Protect network power and physical access
A network can be exposed physically as well as online. Keep network racks, routers and backup drives where visitors cannot casually unplug, reset or take them. Label power supplies and important cables well enough for the people who need to respond, without displaying passwords or confidential details. If a switch, router or recorder is in a public-facing area, consider a locked cabinet or another practical barrier.
Check whether a brief power interruption would take down internet access, phones, cameras or payment devices. A correctly sized backup power unit can give equipment time to ride through a short outage or shut down cleanly, but it is not a substitute for a recovery plan. Record what should come back first after a power event, and test that order while there is no emergency.
8. Make monitoring useful, not noisy
Alerts only help when someone knows what to do with them. Decide which events need attention first: an unexpected administrator sign-in, a new device on the business network, a failed backup, repeated login attempts, a device that goes offline or a router that has not been updated. Record who receives those alerts and what they should do when they arrive.
Cisco’s small-business network security checklist makes the same point in practical terms: monitor traffic through the firewall and ensure someone can interpret the reports and act. A small business does not need to watch every dashboard all day. It does need a way to notice unusual activity and a trusted path for escalating it.
9. Test recovery instead of assuming it will work
Backups protect more than files. They support the recovery of configurations, account records and the information needed to rebuild operations after a device failure or incident. Choose a few important items and test whether they can be restored. Record how long it takes and whether the restored version is usable. A green backup message is not the same as a working recovery.
Keep a copy that is not always connected to the systems it protects, and make sure the people who may need it can find the instructions. The current NIST small-business quick-start guide is built for organizations with modest or no formal cybersecurity plan. It is a useful framework for turning this checklist into a repeatable approach to governing, identifying, protecting, detecting, responding and recovering.
10. Write the first-hour plan and practice it
If a computer shows signs of malware, a user reports a suspicious sign-in or the network becomes unreliable, staff should know what to do before they are under pressure. Write one page with the business decision-maker, technology contact, internet provider, payment processor, insurance contact, software contacts and a way to reach key staff. Keep it accessible even if the main network is down.
Give staff a short reporting rule: pause, preserve useful information and report it quickly. In a suspected infection, disconnect the affected device from the network if it can be done safely, but do not rush to erase evidence or make promises before the facts are clear. The FTC advises businesses to have incident response, disaster recovery and continuity plans that are tested regularly.
11. Use a simple change checklist
Most network problems arrive after a normal business change: a new employee, a new camera, a replacement computer, a new payment terminal or a vendor who needs remote access. Add a short technology check to those decisions. Ask what network it will join, who administers it, whether it needs an update plan, what data it can reach and how it will be removed when the work ends. This prevents convenience decisions from quietly becoming permanent access.
Before a vendor leaves, confirm who owns the administrator account, where configuration information is stored and whether any temporary remote access has been removed. Before a staff member leaves, remove their individual accounts and recover assigned equipment. The same discipline helps when a business changes internet providers or moves locations: confirm the new equipment and settings are known, documented and tested before the old setup disappears.
12. Put the review on the calendar
Good network security is ordinary maintenance. Add a short monthly check for updates, alerts, backups and new accounts. Use a quarterly review for access, equipment support status, guest Wi-Fi, vendor access and the incident plan. Review the relevant items whenever the business adds a location, payment tool, camera system, key employee or remote-work arrangement.
For the wider picture, use the existing small business cyber security checklist alongside this network-focused review. The two work together: one keeps the organization’s essential safeguards visible, while this one keeps the systems carrying that work connected and controlled.
Keep the results in one simple place. A dated checklist with a short note beside each unresolved item is better than an ambitious policy nobody reads. Close what can be closed quickly, assign the work that needs a specialist and revisit the list after significant changes. The goal is not a perfect network diagram. It is a business that can answer the important questions when they matter.
13. Measure the basics before you buy more tools
Before adding another security product, make sure the business can answer the basic operating questions. Which internet connection serves the office? Which device is acting as the firewall? Who can approve administrator changes? Where are the Wi-Fi networks recorded? Which devices can still receive updates? How long would it take to restore the files and accounts the team needs to work? Those answers expose the highest-value next step far better than a generic technology shopping list.
Use the review to make decisions in order. Fix an exposed administrator account before replacing a working printer. Remove an unused remote-access tool before adding another dashboard. Replace unsupported equipment that handles payments or sensitive business information before improving a device that is only inconvenient. This keeps the budget connected to operational risk, downtime and the systems customers depend on.
When an item needs outside help, record the outcome you expect: a separated guest network, an updated firewall, a documented account owner, a tested restore or a clearer response plan. Clear outcomes make it easier to compare support options and confirm the work actually solved the problem. The checklist then becomes part of normal business maintenance, rather than a document that only appears after an interruption.
