// Guide · Security
Cybersecurity checklist for small and mid-sized companies
Twelve points in three blocks — written for companies without a security team, and ordered so that the largest effect comes first.
// The aim
A working list, not a catalogue
Security lists rarely fail on content. They fail on length. Start with a hundred items and you stop at thirty, and those thirty are seldom the effective ones. This list is capped at twelve and sorted so that the first blocks already change something noticeable.
Every point is a question you can answer with yes or no. A no is not an accusation, it is a task. What we put in place operationally is described on our page about cybersecurity for businesses.
Two subjects appear here only in passing, because each has an article of its own: backup along the 3-2-1 rule, and how to act in an orderly way once something has happened. Both are linked below.
// Groundwork
Four things to settle before the list
Without these, every measure is a guess — you end up protecting systems you assume are there.
-
Know what you have
A list of every server, computer, mobile device, network component and cloud service. Anything missing from that list is neither updated nor watched.
-
Know what hurts
Name the two or three systems without which the business stops. They take precedence over everything else at every point on the list.
-
Know who decides
One person with the authority to act, reachable when it matters, allowed to take a system off the network without asking anyone first.
-
Know who helps
Contact details for your provider, your internet supplier and the vendors of your specialist software — printed out, or on a device that works without the company network.
// The checklist
Twelve points in three blocks
Work through the blocks in this order. Each individual point stands on its own — nothing here has to wait for a project.
Who is allowed to do what
- A second factor on every sign-in from outside, and on email
- Separate accounts for administrative work and everyday use
- Permissions granted by role and reviewed on a schedule
- A fixed routine for joiners, movers and leavers
What talks to what
- Updates for operating systems and applications on a fixed cadence
- Protective software on every endpoint, reported centrally
- Network split: administration, production, guests and building services
- Remote access only over a secured connection, never exposed directly
What survives an incident
- A backup with one copy kept outside the network
- A restore genuinely tested at least once a year
- Logs from servers and firewall actually reviewed
- Reporting lines and responsibilities written down
// Priorities
What to do first when time is short
If you cannot take everything on at once, this sequence has proven itself. It sorts by effect rather than by effort.
Harden sign-in
A second factor on everything reachable from outside. This single measure devalues stolen passwords, and stolen credentials count among the most common ways in.
Check the backup
Does a copy exist that an attacker holding your administrator credentials could not delete? If not, that is the most urgent open task on the list.
Get updates on a cadence
A fixed rhythm for operating systems, applications and network equipment. Open vulnerabilities count as the second typical way in.
Tidy network and rights
Separate the network zones and review who has access to what. Both limit how far an incident can travel through the building.
// Limits
What this list does not cover
A checklist is a starting point, not a security concept. These areas stay open and need looking at in their own right.
- Sector-specific obligations, for example in healthcare or in essential supply
- Requirements from client contracts that call for evidence of their own
- Securing machine and control networks, which follow rules of their own
- Staff awareness — technology alone does not catch a convincing email
- Ongoing review of alerts, which nobody manages as a side task
// Common questions
Security questions from smaller businesses
01 Where do we start if we have nothing in place?
With access. A second confirmation at sign-in, tidied permissions and separate administrator accounts take effect immediately and cost very little. Backup comes next, because it limits the damage when something does get through.
02 Is antivirus on every machine not enough?
It is a necessary layer, not a strategy. Attacks frequently arrive through valid credentials or a vulnerability that has been open for months — neither of which antivirus sees, because from its point of view nothing forbidden is happening.
03 Are small companies really a target?
Automated attacks do not look for names, they look for reachable systems. Smaller companies end up in mass campaigns just as larger ones do, often with less slack to absorb an outage.
04 How often should we work through the list?
Once a year in full, plus whenever something fundamental changes: a new site, a new specialist application, a change of provider, or an incident. In between it is enough to revisit the points the change actually touches.
05 What about people who leave the company?
This is one of the most commonly missed points. Accounts, mobile devices, remote access and mail forwarding all need to be closed by the last working day. A fixed handoff between HR and IT stops accounts staying quietly active for months.
06 Do we need a dedicated specialist for all of this?
Not necessarily. Most of the list consists of settings and routines that are configured properly once and then watched. What genuinely needs ongoing attention is updates, log review and verifying that backups still restore.
Dig deeper
All guides
How many points could you answer with yes?
For the ones still open we look together at what is realistic in your environment — and in which order it disrupts day-to-day work the least.