Small businesses do not need a large security department to make meaningful progress. They do need a short list of protections that are real, checked and owned by someone. This small business cyber security checklist is designed for that job. Use it to identify what is already working, what is only partly in place and what needs attention before it becomes an expensive interruption.
The point is not to turn a busy owner into a security specialist. It is to protect the essentials: the email account that resets passwords, the network that connects your POS and cameras, the files that keep operations moving, and the people who make daily decisions. The NIST small business guide offers a sensible framework around governing, identifying, protecting, detecting, responding and recovering. The checklist below turns those ideas into an operational starting point.
1. Put someone in charge of the checklist
Security tasks fail when they belong to “everyone.” Name one person who can collect answers, keep a simple record and call for help when something is unclear. That person does not need to configure every device. They do need to know where the answers live and who owns the next action.
Start a short inventory: business email, payment systems, point-of-sale terminals, cloud storage, laptops, phones, routers, cameras, software subscriptions and the domain registrar. This makes it easier to remove access when staff or vendors change. If your list reveals equipment that is disconnected, undocumented or hard to manage, Matrix's networking and remote help desk support can help organize the practical next steps.
2. Secure the accounts that unlock everything else
Start with email, banking, cloud administration, the domain registrar and remote access. Each should have a named owner, a unique password and multi-factor authentication. Multi-factor authentication means a password alone is not enough to sign in. It is one of the first actions recommended in the small business cyber security guide, alongside updates and backups.
Do not share one login across the team. Give each person their own account, and remove it when their role ends. Keep administrator accounts separate from daily email and web use where the service allows it. Check backup email addresses and phone numbers too. A recovery option that points to a former employee is an open door waiting to be noticed.
3. Keep devices and software supported
Updates are routine maintenance, not an optional extra for a quiet Friday. Turn on automatic updates where you can, then create a simple rhythm for checking the exceptions: computers that stay off overnight, browsers, routers, point-of-sale systems, cameras and software that needs a scheduled update window. Record the systems that cannot update automatically and who is responsible for checking them.
Unsupported operating systems and old network equipment deserve a plan. They may still appear to work, but vendors stop delivering security fixes eventually. When a replacement cannot happen immediately, isolate the equipment, reduce who can reach it and set a deadline. Businesses that run point-of-sale systems or commercial camera systems should include those devices in the same review, not treat them as invisible appliances.
4. Separate the business network from guest and personal use
A business network has more than a Wi-Fi name. Check that the router's default administrator password was changed, its software is current and remote management is not casually exposed. Put guest Wi-Fi on a separate network from staff devices, payment devices, cameras and business computers. That separation limits how far a problem can travel.
Asking the right questions matters more than buying a long list of hardware. Which devices need to talk to one another? Which devices should never be visible to visitors? Who can make changes to the router? Is the internet connection backed by a written account record rather than one person's memory? Matrix can review the setup through its computer and networking services and help turn a confusing equipment cupboard into a manageable business system.
5. Make backups recoverable, not merely scheduled
A green backup notification is not proof that you can recover. Choose a few important items, such as a customer file, a shared document and a mailbox, then test a restore. Time it. Confirm that the recovered version is usable. Write down what happened. That test tells you whether the backup, permissions and instructions work together when pressure is real.
Keep a copy that is not always connected to the same systems you are protecting. Ransomware and account compromises can affect connected files and backups at the same time. The Federal Trade Commission's small business cybersecurity materials include recovery planning guidance, a useful prompt to decide what must be restored first.
6. Reduce the chance of a bad email becoming a bad day
Email is where routine work and urgent-looking requests collide. Give your team a simple rule: pause before paying an invoice, changing bank details, opening an unexpected attachment or sharing a password. A phone call to a known number is safer than replying to the message that created the urgency.
Make reporting easy. Staff should know where to forward suspicious messages and should not feel embarrassed for asking. Short, real reminders work better than a once-a-year lecture nobody remembers. The goal is not to catch every trick. It is to give people permission to slow down before a small mistake becomes an operational problem.
7. Limit access to the people who need it now
Review user lists for email, accounting, cloud storage, scheduling, cameras, POS administration and network equipment. Remove former employees, old vendors and dormant accounts. For current staff, provide the least access that lets them do their job. A front-desk employee does not usually need router administration. A contractor does not need permanent access after the project is complete.
Keep an access-change checklist for hiring, role changes and departures. It should include software accounts, keys, phones, shared folders and physical equipment. This is not glamorous work, but it prevents forgotten access from quietly becoming a risk months later.
8. Know what happens in the first hour of an incident
Write a one-page response plan before you need it. Include the person who makes decisions, your technology contact, your bank or payment processor, insurance contact, internet provider and the owner of critical customer communications. Make clear that an employee who sees a suspicious sign-in, lost device or possible malware should report it immediately rather than trying to hide or fix it alone.
In a serious event, preserve useful information: screenshots, suspicious emails, device names and the time the issue was noticed. Then get qualified help. Do not rush to erase evidence, and do not promise customers anything until you know what happened. NIST frames resilience as more than prevention: a business also needs ways to detect, respond and recover.
9. Review suppliers, payment tools and new technology
Every new app, payment tool, camera installer, web provider or remote-support service adds an access decision. Before approving one, ask what business information it can see, which staff need access, how accounts are removed, and where support requests go. Keep a basic vendor list with account owners and renewal dates.
This is especially important when a business is adding a phone system, updating a website or changing how customers pay. Operational convenience matters, but it should come with clear ownership. For business technology changes that involve multiple systems, a practical conversation with Matrix can help clarify what needs to be connected, separated or documented.
10. Put the checklist on a calendar
Cyber security is maintenance. Set a monthly fifteen-minute review for updates, backup alerts, new accounts and unusual access notifications. Set a quarterly review for access lists and network equipment. After a staff change, new location, new POS installation or major vendor change, revisit the relevant parts immediately.
The best result is not a perfect binder on a shelf. It is a small set of habits that match how your business actually works. Keep records simple enough to use. When the answer is uncertain, make the task visible, assign it and close the loop.
11. Protect payment and customer information
Payment information, customer contact details and employee records deserve an extra look because they can create operational and trust problems if they are exposed. Know where that information is stored, who can export it and how long it needs to be retained. Avoid saving card details, passwords or account numbers in shared spreadsheets, email inboxes or notes apps unless the system was designed and approved for that purpose.
For card payments, use the tools and devices supplied by the payment provider, keep point-of-sale software current and restrict access to the people who need it. If a staff member receives a request to change bank details, send a refund outside normal process or install remote access software, stop and verify it through a known contact. A fast second check is far cheaper than unwinding a payment mistake.
12. Keep physical access on the same checklist
Cyber security is not only online. A visitor, contractor or former employee with access to a back office, unlocked laptop or networking cupboard can create the same kind of disruption as a stolen password. Lock equipment where it makes sense, protect spare keys and keep an eye on who has access to network equipment, security camera recorders and POS administration.
For businesses with cameras and connected door systems, review physical and digital access together. A good setup makes operations easier: the right people can do their jobs, while sensitive equipment and settings are not left open to everyone.
Include this in opening and closing procedures. At the end of the day, check that portable devices are stored, visitor access is cleared and equipment cupboards are secured. In the morning, confirm that the systems people rely on are present, connected and behaving normally. A simple routine catches problems while they are still manageable.
When to bring in support
Bring in help when the checklist exposes unknown administrator accounts, unsupported equipment, confusing network access, failed backups, suspicious activity or a system nobody feels comfortable changing. Matrix supports businesses across Henderson and Las Vegas with practical setup, networking and day-to-day technology assistance. If you want a second set of eyes on what the checklist finds, contact Matrix Technology or call (702) 475-9690.