A cybersecurity checklist for small businesses

Small businesses are attacked for the same reason large ones are: they hold money, data and access to other companies. A small business rarely has a security team, so this checklist does the job. Set aside an afternoon, go through it once, then repeat it every year or whenever something big changes, such as a new office, a new system or a new hire.

It follows the advice of official sources. ENISA, the EU Agency for Cybersecurity, publishes a free Cybersecurity guide for SMEs: 12 steps to securing your business, also in Greek. In Cyprus, the National Cybersecurity Coordination Centre, supported by the Digital Security Authority, offers a Cyber Guide for SMEs and a cyber hygiene framework for small companies on ncc.cy.

1. List what you have

You cannot protect what you do not know about. Write down, in one simple spreadsheet:

• every laptop, phone, tablet and router used for work, and who uses it;
• every online account the business relies on: e-mail, banking, accounting, website, domain name, social media, cloud storage;
• where your important data lives, such as customer records, invoices and contracts;
• which outside companies have access to your systems: your web developer, your accountant, your IT support.

Note who is the owner of each account and who can reset it. The domain name and the main e-mail account matter most. Whoever controls them can take over everything else.

2. Lock down accounts

• Turn on two-step sign-in everywhere it is offered, starting with e-mail, banking and the domain registrar. Passkeys are the strongest option where available. An authenticator app is better than text messages.
• Use a password manager for the team, with a unique, long password for every account.
• Give everyone their own account. Shared logins make it impossible to know who did what, or to remove one person cleanly.
• Keep admin rights to the few people who need them, and use a normal account for daily work.
• Remove access on the day someone leaves, including staff, freelancers and former suppliers.

3. Keep everything updated

Most attacks use weaknesses that already have a fix. Turn on automatic updates for operating systems, browsers and apps on every device. Check the router and any website software, such as WordPress and its plugins, at least monthly. Replace devices that no longer receive security updates. Turn on full-disk encryption and a screen lock on every laptop and phone, so a lost device is only a lost device.

4. Back up, and test the backup

A backup is the difference between a bad day and a closed business after ransomware or a stolen laptop. A simple rule many IT teams use is 3-2-1:

Back up automatically, every day for active data. Keep at least one copy offline or in storage that cannot be changed or deleted for a set period. Then test it: once a quarter, restore a few files and one full folder. Until you have restored from a backup, you do not know that it works. Check that your website host keeps backups too.

5. Secure your e-mail

E-mail is where most attacks start. ENISA's research on small businesses lists phishing and CEO fraud, where someone poses as the boss or a supplier to ask for a payment, among the most common incidents. Two kinds of protection help:

• Technical. Ask whoever manages your domain to set up SPF, DKIM and DMARC. These records let other mail servers check that a message claiming to be from your domain really is, which makes it harder to fake your address. Google and Yahoo have required them from bulk senders since 2024.
• Process. Agree that no payment, and no change of bank details, is ever made on the strength of an e-mail alone. Confirm by phone, on a number you already have.

6. Train your people

Your team is your best sensor. Spend half an hour, twice a year, showing real examples of phishing messages and fake invoices. Make reporting easy and blame-free: someone who clicks a bad link and says so within a minute does far less damage than someone who stays quiet.

7. Write an incident plan

When something goes wrong, nobody thinks clearly. Write one page now and print it:

• who decides, and their phone numbers, including your IT support and your web developer;
• first steps: disconnect the affected device from the network, do not switch it off, change passwords from a clean device;
• who to tell: your bank at once if money is involved, and the police for fraud;
• personal data: unless a breach is unlikely to put people at risk, the GDPR gives you 72 hours from when you learn of it to notify the data protection authority, in Cyprus the Commissioner for Personal Data Protection;
• where to report: CSIRT-CY, the national incident response team at csirt.cy, has a reporting form open to any organisation.

Some larger companies and certain sectors also have legal reporting duties under the EU NIS2 rules. The Digital Security Authority can tell you whether your business is covered.

The one-page checklist

If you would rather have a specialist do this with you, a security check is one of the project types in the planner on our homepage. Your first project on Internetivo explains how a project works, from the first question to approved work.

Common questions

How often should we repeat the audit?

Once a year, and whenever something big changes: a new system, a new office, a new supplier with access, or after any incident.

Is antivirus enough?

It helps, and modern operating systems include it. Most damage still comes through stolen passwords and fake e-mails, so two-step sign-in, updates and backups matter more.

Where can we find official guidance in Greek?

ENISA publishes its 12-step SME guide in Greek, and the National Cybersecurity Coordination Centre of Cyprus offers material for small businesses on ncc.cy.

What is the single most useful step?

Turn on two-step sign-in for your e-mail and your domain. Whoever controls those can reset almost everything else.

Book the afternoon, open a spreadsheet and start with step one. Small, steady habits protect a business better than any single product.