Skip to content

Download

Small business cybersecurity checklist

The 25 controls cyber insurance carriers, HIPAA auditors, and PCI assessors actually ask about — organized so you can walk through your environment and mark each one Yes / No / Partial.

Read below

Published by Green Desert IT — greendesertit.com

Small business cybersecurity checklist

Walk through this with your IT team or MSP. Anything marked No or Partial is a gap worth prioritizing — most cyber insurance renewal questionnaires now require these as baseline.

Identity & access (7 items)

  1. Every user has a unique login (no shared accounts).
  2. Multi-factor authentication (MFA) is required on email, VPN, and cloud services — for everyone, not just admins.
  3. Ex-employees are disabled the same day they leave.
  4. Admin accounts are separate from daily-driver accounts for the same person.
  5. Passwords are managed via a password manager (1Password, Bitwarden, etc.), not sticky notes or Excel.
  6. Access reviews happen quarterly (who has access to what, is it still needed).
  7. Conditional access policies block risky sign-in attempts (impossible travel, unfamiliar countries).

Endpoint security (5 items)

  1. EDR (Endpoint Detection and Response) is installed on every laptop, desktop, and server — not legacy antivirus.
  2. EDR alerts are monitored 24/7 by a SOC (either internal or via MDR).
  3. Full-disk encryption (BitLocker on Windows, FileVault on Mac) is enforced by policy on every endpoint.
  4. OS and third-party app patches deploy automatically within 30 days of release (14 days for critical CVEs).
  5. Screens auto-lock after inactivity (5–15 min depending on physical setting).

Email & data protection (5 items)

  1. SPF, DKIM, and DMARC records are configured on your email domain — DMARC at least in p=quarantine.
  2. Business email accounts have advanced phishing protection enabled (Microsoft Defender for O365 or equivalent).
  3. Users receive phishing awareness training with measurable simulated-phish click-through-rate tracking.
  4. External sharing of files and folders is limited to explicit users, not "anyone with the link" by default.
  5. DLP (Data Loss Prevention) rules flag or block sensitive data (SSNs, credit cards, PHI) from being emailed externally.

Backup & recovery (4 items)

  1. Every critical system (email, file storage, database, ERP) has an automated backup running daily.
  2. Backups are stored off-site or in a cloud region separate from production.
  3. Restore tests happen monthly and are documented (if it's not restore-tested, it's not a backup).
  4. A documented disaster recovery plan defines RTO (recovery time objective) and RPO (recovery point objective) per system.

Governance & response (4 items)

  1. A written incident response runbook exists and names specific people, phone numbers, and outside partners (forensics firm, breach counsel, cyber carrier).
  2. The IR plan is tested via tabletop exercise at least annually.
  3. Vendor risk register: every third party with access to systems or data is documented with a signed contract (BAA for HIPAA-covered entities).
  4. Formal risk analysis is refreshed annually and after material environment changes.

Score interpretation:

  • 22–25 Yes: Solid baseline. You should pass most cyber insurance renewals without friction.
  • 15–21 Yes: Meaningful gaps. Prioritize items 2 (MFA), 8 (EDR), 20 (restore tests), and 22 (IR plan) first — these produce the largest risk reduction fastest.
  • Under 15 Yes: This is where most breaches happen. Get expert help — either an internal hire or a managed IT partner.

Published by Green Desert IT — feel free to redistribute or adapt. A link back to greendesertit.com is appreciated if you republish.

Get more resources like this

Buyer guides, checklists, and honest opinions on managed IT and cybersecurity. Two emails a month, unsubscribe any time.

Want an expert to walk through this with you?

Book a 20-minute call and we'll score your environment on the same 25-item scale, live.

Book a 20-minute intro call