Key Takeaways
- Start with accounts. Multi-factor sign-in on email and banking stops more break-ins than any other single step.
- Backups only count if you have restored from them. Test one file and one full device each quarter.
- Most small business incidents begin with a message, not a hack. Train staff and filter email.
- Keep a one-page list of who to call. Speed in the first hour matters more than a perfect plan.
- You can finish the first ten items yourself. The last ten usually need outside help.
If you run a small business in Dallas, you probably have no one whose job is security. You have a bookkeeper, a few laptops, a shared drive and an email account that holds your whole business. That is exactly the setup attackers look for. They do not need to know you. They scan for easy doors, and a small office with default settings is an easy door. If you want help closing them, cybersecurity services can take most of this off your plate.
This checklist has 20 items in five groups. It is written for owners and office managers, not engineers. Each item is a yes or no question. If the answer is no, or you are not sure, that item goes on your fix list. Most offices find six to ten gaps on the first pass, and that is normal.
Work through it with a pen and one hour. Do not try to fix everything at once. Mark each gap as high, medium or low, fix the high ones first, and come back to the rest next month.
How to Use This Checklist
Read each item and answer yes, no or not sure. Treat not sure as no. A control you cannot confirm is a control you cannot count on during a bad day.
Print the list or paste it into a spreadsheet. Add two columns: who owns the fix and a target date. Owners matter. An item with no name next to it rarely gets done.
- Score one point for every yes. Under 10 means you have real exposure.
- Between 10 and 16 means you have a decent base with specific holes.
- 17 and above is strong for a business your size. Keep testing it.
Run the list again twice a year. Staff change, software changes and a setting that was right in January may be wrong by July.
A first pass usually takes under an hour when one person owns the list.
Accounts & Passwords (Items 1 to 5)
Stolen logins are behind most small business break-ins. These five items cost little and block the most common attacks.
- 1. Multi-factor sign-in on email. Every mailbox needs a second step, such as a phone prompt, not just a password.
- 2. Multi-factor on banking and payroll. Turn it on for every financial portal, even if the bank calls it optional.
- 3. A password manager for staff. People reuse passwords when they have no other way to remember them.
- 4. No shared logins. Each person gets their own account so you can see who did what and remove access fast.
- 5. A leaver checklist. When someone quits, their email, apps and phone access are shut off the same day.
Item 4 trips up many offices. A shared login for the accounting package feels convenient until a former employee still has it six months later.
A phone approval takes about five seconds and blocks a stolen password on its own.
Devices & Software (Items 6 to 10)
Every laptop, phone and printer is a door into your network. Keep them current and you close most of the doors that attackers use.
- 6. Automatic updates. Windows, Mac and key apps install fixes on their own, with restarts scheduled outside work hours.
- 7. Endpoint protection. Every computer runs security software that is managed and reporting, not a free trial that expired.
- 8. Disk encryption. If a laptop is left in a car near Deep Ellum or at DFW, the data stays unreadable.
- 9. A device list. You know every computer and phone that touches company data and who has it.
- 10. Screen lock and remote wipe. Lost phones can be locked and erased from a console, not just hoped about.
Item 9 is the one most owners skip. You cannot protect what you cannot list. A simple spreadsheet of device, owner, purchase date and operating system is enough to start.
For a deeper look at weak points across those devices, a vulnerability assessment scans them and ranks what to fix first.
Email, Network & Backups (Items 11 to 15)
These five items protect the places where work actually happens. They are also where a quiet mistake turns into a closed week.
| Item | What good looks like | Common gap |
|---|---|---|
| 11. Email filtering | Spam, phishing and bad attachments are caught before staff see them | Only the basic built-in filter is on |
| 12. Business Wi-Fi | Staff and guests are on separate networks with strong passwords | One shared network for everyone, including customers |
| 13. Firewall | A business-grade firewall that is updated and monitored | A consumer router from an internet provider |
| 14. Backups | Offsite copies, at least one that cannot be changed or deleted | One USB drive plugged into a desk |
| 15. Restore test | A file and a full device are restored each quarter | Backups have never been tested |
Item 15 is the one that saves businesses. Many owners learn their backup was empty only on the day they needed it. Restore one file this week, then a full laptop next quarter.
A business firewall costs a few hundred dollars, while a consumer router offers little more than basic filtering.
People, Policies & Response (Items 16 to 20)
Technology covers most of the list, but people decide whether a link gets clicked. The last five items are about habits and planning.
- 16. Short security training. Staff see a few real phishing examples at hire and again each year.
- 17. A payment confirmation rule. Any change to bank details or any large transfer is confirmed by phone with a known number.
- 18. A written one-page policy. It covers passwords, personal devices and what to do with a suspicious message.
- 19. An incident contact sheet. Your IT provider, your insurer and your bank have phone numbers on one page.
- 20. Cyber insurance reviewed. You know what your policy covers and what it requires, such as multi-factor sign-in.
Item 17 stops one of the costliest small business scams. A fake email from a vendor asks you to send payment to a new account. A callback to a number you already have ends it in a minute.
Insurance questions often drive the rest of the list. Carriers now ask about multi-factor, backups and endpoint protection before they quote.
Fix It Yourself, Hire Help, or Mix
Not every item needs a consultant. The right split depends on your size, your tools and how much time you can spare. Here is a realistic view for a business of 10 to 50 people.
| Approach | Typical fit | Items it covers well |
|---|---|---|
| Do it yourself | Under 10 people, simple tools | 1 to 5, 16 to 19 |
| Outside consultant, one time | Need a plan or a second opinion | Gap review, policy, priorities. See cybersecurity consulting |
| Ongoing managed security | No time or staff for daily upkeep | 6 to 15, with monitoring and updates. See managed security services |
Many owners start on their own and bring in help for items 6 to 15, where the work is steady and technical. Cost is usually the next question, and the small business cybersecurity cost guide shows typical monthly ranges.
A one-hour review with an adviser often turns a vague worry into a short, ranked fix list.
When to Test Your Defenses
A checklist tells you what you have set up. It does not prove those settings hold up against someone trying to get in. Testing does.
Most small offices do not need a full test in year one. Finish the checklist first, since testing a network with open gaps only confirms what you already know. Once the basics are in place, a penetration test checks whether an attacker could still get through.
Test sooner if you handle client financial data, health records or card payments, or if a customer contract asks for proof. Test again after a big change, such as a new office, a new line of software or a move to the cloud.
Budget matters here, so read the penetration testing cost breakdown before you request quotes. Prices vary widely with scope, and a clear scope keeps the bill predictable.
A checklist is only useful if it leads to action. Pick the three items you answered no to that carry the most risk, usually email sign-in, backups and endpoint protection, and give each an owner and a date this month. Small steps done in order beat a big plan that never starts.
If you would rather not work through the list alone, you can ask for a free IT assessment. A technician checks your accounts, devices, email and backups, then gives you a written list of what to fix first and what it typically costs. There is no pressure and no long contract to read.
FAQs
How long does it take to complete a cybersecurity checklist for a small business?
Most owners finish the first pass in about an hour, since each item is a yes or no. Fixing the gaps takes longer. Simple items like turning on multi-factor take minutes. Items like replacing a firewall or setting up tested backups can take a few days of planning and work.
What is the most important item on the list?
Multi-factor sign-in on email is the highest value single step. Email resets passwords for nearly everything else, so a stolen mailbox leads to many other accounts. Backups you have actually restored come a close second, because they decide whether an attack is an annoyance or a crisis.
Do small businesses in Dallas really get attacked?
Yes. Attackers mostly use automated scans and mass phishing, so they do not choose targets by name or city. A small office with weak passwords and no email filtering gets hit for the same reasons a larger one does. Small firms just have fewer resources to recover.
Can I do all 20 items without an IT provider?
Many owners can handle the first five and the last five on their own. The device, network and backup items are more technical and need steady upkeep. If no one in your office has the time or skill, a provider keeps those items current so they do not slip.
How often should I review this checklist?
Twice a year is a good rhythm, and again after any big change such as a new hire group, a new office or new software. Run the restore test for backups every quarter. Settings drift over time, and a yearly review is often too slow to catch it.
Caleb Whitaker
Editorial Director, Byte Dallas
Caleb runs the Byte Dallas editorial desk and turns what our technicians see every week, from hail-season outages to office moves along the Tollway, into straight answers for Dallas business owners. A Dallas native, he has worked in IT services for more than 15 years, first answering help desk calls and later leading network and support projects for accounting firms, clinics and distributors across North Texas. He holds Microsoft 365 and CompTIA Security+ certifications. These days he spends much of his time on practical AI, such as Microsoft Copilot, and on how small teams can use it without exposing client data. Every guide he publishes is reviewed by a working technician first.