A small business security checklist before the next incident
Practical steps for account access, phishing reports, backups and incident response that small teams can prepare before an attack.
A security incident is easier to handle when the team has already agreed on who can isolate an account, where backups live and how to reach customers. This checklist focuses on basic defensive steps that smaller teams can put in place without a dedicated security department.
Protect accounts and recovery paths
Require multifactor authentication for email, cloud consoles, source control and finance systems. Prefer phishing-resistant methods where available. Remove access promptly when people change roles, give each person an individual account, and store recovery codes somewhere protected from the account they recover.
Make reporting easy
Tell staff how to report a suspicious message, unexpected login prompt, lost device or unusual payment request. Do not shame someone for reporting a mistake quickly. Verify changes to bank details or urgent transfers through a second known channel instead of replying to the message that requested them.
Know how to contain and recover
Keep offline or separately protected backups and test that a restore works. Write down who can disable a compromised account, rotate a leaked credential, contact the hosting provider and preserve evidence. If a service may be compromised, use a clean device to change credentials and revoke active sessions; do not delete logs before the incident lead has reviewed them.
Use a short incident checklist
- Record what happened, when it was noticed and which systems may be involved.
- Contain the affected account or device without destroying useful evidence.
- Contact your hosting, identity or payment provider through a verified channel.
- Restore from a known-good backup and rotate exposed secrets.
- Review the entry point and update the response plan after recovery.
This is operational guidance, not incident-response or legal advice. For an active compromise, contact your security provider and relevant authorities promptly. CISA’s ransomware guidance and the NIST Cybersecurity Framework provide additional planning resources.