A strong cybersecurity checklist for small businesses should cover eight areas: account access, MFA, endpoint protection, patching, backups, threat monitoring, employee training, and incident response. Review each area at least annually, close obvious gaps, and assign someone to own the follow-up rather than assuming existing security controls still work as intended.
The FBI received more than 1 million internet crime complaints in 2025, with reported losses reaching $20.9 billion. That was a 26% increase in losses from the year before. These staggering numbers make Cybersecurity Awareness Month an important annual checkpoint for any growing business.
“Security is built one choice at a time, by everyone on your team. Those small decisions, made every day, shape a security-minded organization.”
—Griffin Dickerson, Cybersecurity and Compliance Advisor, Vitis Technologies
A lot can change in twelve months, increasing your business’s cybersecurity risks: employees leave, new cloud tools show up, vendors get access to systems, laptops age, a backup task that worked in January fails in September but you don’t get notified.
Evaluating your IT at least once a year is an important part of reducing your risk.
Use October to check the basics (yes, again)
NIST describes cybersecurity as a continuous process because businesses, technology, regulations, and threats keep changing. Its small-business guidance recommends basics including MFA, strong passwords, tested backups, updated software, and maintained antivirus protection.
For most SMBs, your annual review doesn’t need to be a massive audit. Start here:
| Category | What to do |
|---|
| Identity | Remove stale users and unnecessary admin access |
| MFA | Confirm important accounts require MFA |
| Endpoints | Check protection across laptops, desktops, and servers |
| Patching | Find devices and software falling behind on updates |
| Backups | Verify what’s backed up and test a restore |
| Monitoring | Confirm someone actually reviews security alerts |
| Training | Refresh phishing and safe-use habits with employees |
| Incident response | Confirm everyone knows who does what during an incident |
The point isn’t to get eight perfect scores. It’s to find any gaps before someone else does.
Vitis approaches these areas as connected parts of Managed Cybersecurity Services, including identity protection, endpoint security, monitoring, employee awareness, and security planning.
Start with accounts and access
It’s easy to forget who has what access. It could be a former employee still using their employee Microsoft 365 account, a vendor with administrator privileges long after a project ends, or three people using the same shared login because changing the process feels inconvenient (or adding a user is “too expensive”).
Now is a good time to clean that up.
Review:
- Active user accounts
- Administrator permissions
- Vendor and contractor access
- Shared credentials
- MFA coverage
NIST recommends MFA for accounts that support it, with phishing-resistant options considered for sensitive applications. It also recommends removing access as roles change or employees leave.
Review the devices people use
Security policies don’t matter much when the laptop carrying company data hasn’t been updated in six months. Pull and review your real device list, including remote employees.
Look at these items: Are operating systems current? Is endpoint protection active? Are disks encrypted? Are devices still checking into management tools?
One forgotten laptop can become the weak point in an otherwise well-managed environment.
Patching deserves the same attention. Unsupported software and delayed updates give attackers opportunities that businesses can often remove with routine maintenance.
Test recovery by doing it
Seeing a green checkmark next to “backup completed” isn’t the same as knowing the business can recover.
Instead, pick something and restore it: a mailbox, a folder, a server. The exact test matters less than proving the recovery process works and understanding how long it takes.
Make sure you also answer the following questions:
- Which systems are backed up?
- How often does backup run?
- Who receives failure alerts?
- Can an attacker reach the backup environment?
- How long could the business operate without those systems?
That’s where cybersecurity planning overlaps directly with Business Continuity and Disaster Recovery.
Make sure someone is watching
Businesses sometimes buy security tools and assume the job is done.
It isn’t.
An alert only helps when someone sees it, understands it, and knows what to do next. Review where firewall, endpoint, identity, and cloud security alerts go. Find out who watches them after hours. Check what happens when something looks serious.
Refresh employee training with real examples
Annual training can quickly become background noise. Invite people to share what they run across, and spend 5 minutes every month sharing situations employees have recently faced:
- Fake Microsoft login pages
- Vendor payment changes
- Unexpected QR codes
- Shared-file phishing emails
- Suspicious MFA prompts
- Requests for passwords or sensitive data
The goal isn’t to shame anyone or make employees afraid of every email. Teach them when to pause, verify, and report. A five-minute conversation built around real-world phishing examples is more relevant than an hour of generic slides.
Write down the first hour of an incident
NIST’s current incident-response guidance treats preparation, detection, response, and recovery as parts of ongoing cybersecurity risk management.
Your employees should know the basics of your response plan before anything happens. This isn’t complicated. Answer the following questions in writing, and make sure people know where to find it.
- Who gets called first?
- Who can disable an account?
- Who contacts the insurer?
- Who talks to leadership?
- Who makes decisions about shutting down systems?
A short plan people can find beats a detailed plan nobody remembers exists.
Cybersecurity checklist questions SMBs ask
How often should a small business review its cybersecurity?
A full review at least once a year is a good baseline, with account access, patches, alerts, and backups checked more frequently. Major staffing, technology, or vendor changes should also trigger a review.
What should a small business check first?
Start with identity. Review active accounts, administrator access, MFA, and former employee or vendor accounts. Stolen credentials remain one of the simplest ways for attackers to gain access.
Is having antivirus and a firewall enough?
No. They’re useful layers, but businesses also need access controls, MFA, patching, endpoint protection, backups, monitoring, employee training, and a response plan.
How do we know whether our backups actually work?
Run a restore test. Confirm that the data can be recovered, measure how long it takes, and document who owns the process. A successful backup job alone doesn’t prove recovery will work.
Don’t carry this year’s security gaps into the next one
Cybersecurity Awareness Month gives businesses a convenient reason to look at controls they’ve stopped noticing. Check the accounts. Check the devices. Restore something. Look at the alerts. Ask employees what they’d do with a suspicious email. Find the incident plan.
You’ll see pretty quickly where “good enough” needs work.
Not sure where your gaps are?
Vitis can help you find them before someone else does. Talk to Vitis →
%20(1).png)
.jpg)
