{
  "@context": "https://schema.org",
  "@type": "Article",
  "url": "/managed-it-services/it-security-checklist-small-business",
  "markdownUrl": "https://www.desaiinfo.net/kb/managed-it-services/it-security-checklist-small-business.md",
  "publisher": {
    "name": "Desai InfoTech",
    "url": "https://www.desaiinfo.net"
  },
  "type": "article",
  "slug": "it-security-checklist-small-business",
  "pillar": "managed-it-services",
  "order": 2,
  "title": "IT Security Checklist for Small Businesses and Nonprofits",
  "metaTitle": "IT Security Checklist for Small Businesses (2026)",
  "description": "A practical IT security checklist for small businesses and nonprofits covering identity, devices, email, backup, network, training and incident response.",
  "keywords": [
    "it security checklist",
    "small business cybersecurity checklist",
    "nonprofit cybersecurity",
    "cis controls ig1",
    "mfa small business"
  ],
  "published": "2026-10-17",
  "updated": "2026-10-17",
  "summary": "An IT security checklist for a small business should start with the controls that stop the most common attacks: multi-factor authentication on every account, separate admin accounts, automatic patching, endpoint detection and response, email authentication and filtering, encrypted devices, tested backups and staff phishing training. Add network segmentation, logging and a written incident response plan, then review the list quarterly.",
  "keyTakeaways": [
    "Identity is the new perimeter; MFA and admin account hygiene come first.",
    "Patching, EDR and disk encryption should be enforced by policy, not left to users.",
    "Backups only count if they are isolated from production credentials and restore-tested.",
    "A one-page incident response plan with phone numbers beats a long document nobody reads.",
    "Use a recognized framework such as CIS Controls Implementation Group 1 to track progress."
  ],
  "howTo": {
    "name": "How to secure a small business IT environment",
    "totalTime": "P8W",
    "steps": [
      {
        "name": "Lock down identity",
        "text": "Enforce MFA for all users, create separate admin accounts and disable legacy authentication."
      },
      {
        "name": "Secure devices",
        "text": "Enroll devices in management, enforce encryption and automatic updates, and deploy EDR."
      },
      {
        "name": "Protect email",
        "text": "Configure SPF, DKIM and DMARC and enable phishing and malware filtering."
      },
      {
        "name": "Back up and test",
        "text": "Back up devices, servers and SaaS data following 3-2-1, then perform a restore test."
      },
      {
        "name": "Segment the network",
        "text": "Separate staff, guest and IoT traffic with VLANs and keep firewall firmware current."
      },
      {
        "name": "Train and plan",
        "text": "Run phishing awareness training and write a one-page incident response plan."
      }
    ]
  },
  "faqs": [
    {
      "q": "What is the most important security control for a small business?",
      "a": "Multi-factor authentication on every account, especially email and administrator accounts, is the single highest-value control for most small organizations because so many breaches start with a stolen password. Pair it with blocking legacy authentication protocols, which can bypass MFA, and use phishing-resistant methods such as passkeys or security keys for admins."
    },
    {
      "q": "Is antivirus enough for a small business?",
      "a": "Traditional signature-based antivirus is no longer enough on its own. Endpoint detection and response (EDR) tools, such as Microsoft Defender for Business or comparable products, record behavior on the device, detect suspicious activity like ransomware encryption and allow a responder to isolate the machine remotely. EDR is only effective if someone actually monitors and responds to its alerts."
    },
    {
      "q": "What security framework should a small business follow?",
      "a": "CIS Controls Implementation Group 1 (IG1) is a practical starting point designed for organizations with limited IT resources. The NIST Cybersecurity Framework is useful for structuring a broader program, and CISA publishes free guidance for small businesses. Choose one, assess against it and track improvement over time rather than trying to meet several at once."
    },
    {
      "q": "How often should we review our security checklist?",
      "a": "Review the checklist at least quarterly and after any significant change, such as a new office, a new cloud application, staff turnover in IT or a security incident. Quarterly reviews catch drift, like an MFA exception that was never removed or a device that stopped reporting patches. Annual reviews are also a good time to retest backups and update the incident response plan."
    }
  ],
  "related": [
    {
      "title": "How to Build a Backup and Disaster Recovery Plan for a Small Business",
      "url": "https://www.desaiinfo.net/managed-it-services/backup-disaster-recovery-plan"
    },
    {
      "title": "Endpoint Management with Microsoft Intune: A Small Business Guide",
      "url": "https://www.desaiinfo.net/managed-it-services/endpoint-management-intune-guide"
    },
    {
      "title": "Firewall Security Best Practices for Small Businesses",
      "url": "https://www.desaiinfo.net/networking-services/firewall-security-best-practices"
    },
    {
      "title": "Zero Trust Network Architecture for Small Businesses",
      "url": "https://www.desaiinfo.net/networking-services/zero-trust-network-architecture"
    },
    {
      "title": "Microsoft 365 Administration Best Practices for Small Businesses",
      "url": "https://www.desaiinfo.net/managed-it-services/microsoft-365-administration-best-practices"
    },
    {
      "title": "Azure Security Assessment for Small Businesses",
      "url": "https://www.desaiinfo.net/azure-consulting/azure-security-assessment"
    }
  ],
  "url_path": "/managed-it-services/it-security-checklist-small-business",
  "bodyMarkdown": "Small businesses and nonprofits are targeted by the same phishing, ransomware and business email compromise campaigns as large enterprises, usually with far less staff to defend against them. This checklist focuses on the controls that block the most common attacks first. It is the baseline we apply in every [managed IT services](https://www.desaiinfo.net/managed-it-services) engagement, and it maps loosely to CIS Controls Implementation Group 1 (IG1).\n\n## Where should a small business start with IT security?\n\nStart with identity, then devices, then email and backup. Most real-world compromises of small organizations begin with a stolen password or a phishing email, so controls in those areas deliver the most protection per dollar.\n\nWork through the sections below in order. Mark each item as done, in progress or not applicable, and assign an owner and target date to everything that is open.\n\n## Identity and access checklist\n\nIdentity is now the primary security perimeter, because staff access cloud apps from anywhere.\n\n| Control | Why it matters | Done |\n|---|---|---|\n| MFA enforced for every user account | Stops most password-based account takeover | [ ] |\n| Legacy authentication protocols blocked | Old protocols such as basic auth for POP and IMAP can bypass MFA | [ ] |\n| Separate named admin accounts, not used for email or browsing | Limits damage if a daily-use account is phished | [ ] |\n| Phishing-resistant MFA (passkeys, FIDO2 keys) for admins | Resists adversary-in-the-middle phishing kits | [ ] |\n| No shared accounts; shared mailboxes used instead | Preserves accountability and allows MFA | [ ] |\n| Offboarding disables access the same day | Prevents former staff or volunteers from retaining access | [ ] |\n| Password manager provided to staff | Reduces password reuse | [ ] |\n| Conditional access requires compliant devices for sensitive apps | Blocks access from unmanaged or compromised devices | [ ] |\n\nIn Microsoft 365, conditional access requires Entra ID P1, which is included in Microsoft 365 Business Premium. Our [Microsoft 365 administration best practices](https://www.desaiinfo.net/managed-it-services/microsoft-365-administration-best-practices) covers tenant hardening in more detail.\n\n## Device and endpoint checklist\n\nEvery laptop, desktop and phone that accesses company data should be managed and monitored.\n\n- [ ] All company devices enrolled in a management platform such as Microsoft Intune\n- [ ] Operating system and browser updates installed automatically, with compliance reporting\n- [ ] Third-party applications (PDF readers, Zoom, Java and similar) patched or removed\n- [ ] Endpoint detection and response (EDR) installed, with alerts monitored by a person\n- [ ] Full-disk encryption enabled (BitLocker on Windows, FileVault on macOS)\n- [ ] Users are not local administrators on their devices\n- [ ] Screen lock after a short idle period\n- [ ] Lost or stolen devices can be remotely wiped\n- [ ] Devices past vendor end-of-support are scheduled for replacement\n\nThe [Intune endpoint management guide](https://www.desaiinfo.net/managed-it-services/endpoint-management-intune-guide) explains how to enforce these settings by policy rather than by hand.\n\n## Email security checklist\n\nEmail remains the most common entry point for attacks and fraud.\n\n- [ ] SPF, DKIM and DMARC configured for every domain you send from, with DMARC moving toward enforcement\n- [ ] Anti-phishing, anti-malware and safe-link or attachment scanning enabled\n- [ ] External sender tagging enabled so staff can spot impersonation\n- [ ] Automatic forwarding to external addresses blocked by default\n- [ ] A clear process for verifying payment or banking changes by phone, using a known number\n\nThat last item is a process control, not a technical one, and it is one of the most effective defenses against business email compromise and invoice fraud.\n\n## Backup and recovery checklist\n\nBackups are your last line of defense against ransomware, accidental deletion and hardware failure.\n\n- [ ] Backups follow the 3-2-1 rule: three copies, two media types, one offsite\n- [ ] At least one copy is immutable or isolated from your production admin credentials\n- [ ] Microsoft 365 or Google Workspace data (mail, OneDrive, SharePoint, Teams) is backed up by a third-party tool, not only retained by the platform\n- [ ] Restore tests are performed and documented at least quarterly\n- [ ] Recovery time and recovery point objectives are defined for key systems\n\nSee [how to build a backup and disaster recovery plan](https://www.desaiinfo.net/managed-it-services/backup-disaster-recovery-plan) for a full walkthrough.\n\n## Network security checklist\n\nThe network still matters, especially for offices with printers, phones, cameras and guest Wi-Fi.\n\n- [ ] Business-grade firewall with current firmware and active vendor support\n- [ ] Default admin passwords changed on all network equipment\n- [ ] Guest Wi-Fi isolated from staff networks\n- [ ] IoT devices (cameras, smart TVs, building systems) on their own VLAN\n- [ ] Remote access via a modern VPN with MFA or a zero trust access service\n- [ ] No management interfaces exposed to the internet\n- [ ] DNS filtering to block known malicious domains\n\nThe networking side is covered in depth in [firewall security best practices](https://www.desaiinfo.net/networking-services/firewall-security-best-practices) and [zero trust network architecture](https://www.desaiinfo.net/networking-services/zero-trust-network-architecture).\n\n## People and process checklist\n\nTechnology controls fail without informed staff and clear procedures.\n\n- [ ] Security awareness training at onboarding and at least annually, with periodic phishing simulations\n- [ ] A one-page incident response plan with who to call, including your IT provider, cyber insurer and legal counsel\n- [ ] An asset inventory of devices, software and cloud services\n- [ ] An acceptable use policy that staff and volunteers acknowledge\n- [ ] Cyber insurance requirements reviewed and evidence kept current\n- [ ] Logs from Microsoft 365, firewall and EDR retained long enough to investigate an incident\n\n## How do nonprofits adapt this checklist?\n\nNonprofits should apply the same controls, with extra attention to volunteers and donor data. Give volunteers individual accounts with the minimum access needed and an end date, rather than sharing a staff login. Keep donor and client databases behind MFA and conditional access, and check whether your donor management or case management vendor supports single sign-on. Microsoft and other vendors offer nonprofit licensing that can make security-focused plans more affordable for eligible organizations.\n\n## What should you do after completing the checklist?\n\nTreat the checklist as a living document. Review it quarterly, after staff changes in IT and after any incident. If your workloads run in Azure, extend the review to cloud resources with an [Azure security assessment](https://www.desaiinfo.net/azure-consulting/azure-security-assessment). If you want help assessing your environment against this list, [contact Desai InfoTech](https://www.desaiinfo.net/contact) for a security review."
}