Try this 30-minute cybersecurity check from a pro

• Map what matters: List all the information your customers trust you to keep, where it lives and who has access.
• Lock those security doors: Check for multi-factor authentication (MFA) on your accounts, confirm how critical data is backed up and flag anything you need your provider to explain (you may already have protections in place).
• Choose your next steps: Use this 30-minute check to find the gaps, choose three priorities, assign responsibility and set dates to verify completion.

In 2025, the FBI’s Internet Crime Complaint Center recorded nearly $21 billion in losses due to internet crime. Business email compromise alone accounted for about $3 billion of that total. Those numbers aren’t limited to small businesses, but they show that small-business owners need to have a cybersecurity plan. That’s what we’re going to talk about here.

When it comes to cybersecurity for small businesses, the biggest gaps are often pretty basic: who has access, whether multi-factor authentication (MFA) is turned on, where sensitive information lives, whether backups are in place and whether you know what to do if something goes wrong.

In the next 30 minutes, I’ll help you build a simple cybersecurity checklist: what matters to your business, where it lives, who can access it and which protections you can confirm. You’ll finish with three priorities to follow up on. You won’t solve every security issue today, but you’ll have a clearer sense of where to focus and when to ask for help.

I call this approach Trust and Verify: Understand what your business depends on, identify who is responsible for protecting it and check what protections are in place.

• Open a spreadsheet or grab a piece of paper.
• Don’t include passwords, account numbers or actual customer information, and keep the completed checklist somewhere secure.
• If an answer takes more than a few minutes to find, mark it “unknown” and keep moving. That’s a useful finding—and something to follow up on.

Start by putting these labels at the top of the first columns of your spreadsheet:

• What am I protecting?
• Where does it live?
• Who can access it?

Then start filling out the rest. Think about what information your business depends on or has been trusted to keep private, like customer and employee data, payment card information, contracts, financial information or even health information. Contracts might live on a laptop and a cloud drive. Payroll may go through an outside service. Invoices come to you through email. Start mapping all of it here.

Here’s a spreadsheet example:

If you don’t know, mark it unknown and follow up later.

Now add a fourth column: What protections have I verified?

Start with the accounts that would cause the biggest problem if someone got in: email, banking, payroll, cloud storage, booking systems and administrator accounts. Check whether MFA is turned on. MFA adds a layer of protection beyond a password. It is not a guarantee, but it is one of the basic protections worth verifying.

While you’re checking those accounts, flag any passwords being shared by email or saved in a document as something to fix next.

Review the systems on your map and ask: Who is helping me protect this?

You may already have security through your internet provider, mobile carrier, email provider, booking platform or another technology company without knowing what is turned on.

Make a list of your providers and plan to call or open a support chat and ask these six questions:

1. What security is already active?
2. Is a firewall enabled on my business router, and who manages its settings?
3. Is there spam, phishing email or mobile protection?
4. Is anything included that I still need to turn on?
5. What is still my responsibility?
6. Is sensitive business information encrypted where it is stored and when it is shared—including on devices, cloud services and backups?

If the answer takes more than a few minutes to find, mark it “unknown,” assign a follow-up and keep moving. If you are not sure, ask the provider responsible for each system.

Then put what you learn into column 4: Name the system and protection you verified; if something is still unknown, record that too.

Put a star next to any row connected to a person or company you regularly pay—an employee, vendor, contractor, payroll provider, landlord or other business partner.

Here’s why: One common social engineering scam is a sudden request to change how a vendor gets paid. Now make one rule: If anyone or any company suddenly asks to be paid a different way, stop and confirm it another way.

For example, if a vendor emails new bank details or a different payment link, don’t rely on that message alone. Call them using a phone number you already know and trust.

Now add a fifth column: What do I need to do next?

Pick the systems that matter most and ask these questions:

• What is backed up?
• When was the last successful backup?
• Has someone tested restoring it?

Put the answer—or the gap—into “What do I need to do next?”

Want a more complete cybersecurity checklist? The Center for Internet Security, a nonprofit organization that develops widely used cybersecurity best practices, offers the CIS Controls Implementation Group 1 as a starting point for essential cyber hygiene. If you use an office software product like Microsoft 365, ask your administrator to review how secure it is (e.g., by reviewing the Microsoft Secure Score) with you and explain the recommended security improvements for your setup.

Check the “What do I need to do next?” column. Pick three. For each one, name the person responsible, set a completion date and note how you will verify it is done. For example, assign someone to enable payroll MFA, set a deadline and verify the account settings afterward.

That’s your last five minutes. And if the list tells you that you need outside help, make the appointment. A cybersecurity professional or managed service provider can assess what you have, tell you what matters most and help you build from there.

Also add a follow-up to review your cyber insurance and crime coverage with your insurance professional. Ask whether payment fraud is covered, what exclusions or limits apply and which security requirements you must meet.

These cybersecurity tips for small businesses aren’t meant to turn you into your own cybersecurity department. They are meant to help you become a business owner who knows enough to be part of the conversation. And that is the point. You worked hard to build a business people trust. Protecting the information, systems and relationships they trust you with is part of protecting everything you built.