Cybersecurity Awareness Month: A 12-Point Security Checklist for Small Businesses

Every October, National Cybersecurity Awareness Month brings a wave of advice aimed at large enterprises with dedicated security teams. Small businesses get the same threats — phishing, ransomware, credential theft — without the dedicated team. This checklist skips the enterprise jargon and focuses on what a business with 10-50 employees can actually verify this month.

Go through each item. If you can't confidently check a box, that's your starting point.

Access & Identity

1. Multi-factor authentication is enabled on email, banking, and any system holding customer data. This single control blocks the majority of account-takeover attempts, since a stolen password alone is no longer enough to get in.

2. No one shares login credentials. Shared logins mean no one can tell who actually did what when something goes wrong — and they're the first thing that breaks when someone leaves the company and nobody remembers to change the password.

3. Former employees' access was actually revoked, not just "probably fine." Check this directly rather than assuming — email, file shares, and any SaaS tools they had access to.

Backups & Recovery

4. Backups run automatically, not "when someone remembers." Manual backup processes fail exactly when you need them, because the one time it's skipped is the time disaster strikes.

5. A backup has actually been tested by restoring from it. A backup that's never been restored is a backup you're hoping works, not one you know works.

6. Backups are stored somewhere a ransomware attack on your main systems can't also reach them. If your backup drive is permanently connected to the same network as everything else, an attacker who gets in can often encrypt or delete both at once.

Devices & Software

7. Software updates and security patches are applied automatically, not left for someone to remember. Most successful attacks exploit vulnerabilities that were already patched months earlier — the gap is in applying the fix, not the fix existing.

8. Antivirus/endpoint protection is active on every device that touches business data, including any personal laptops or phones used for work.

9. Old, unused accounts and software have been removed, not just disabled. Dormant accounts are a common, quiet way in.

People & Process

10. Your team has been shown what a real phishing email looks like, not just told "don't click suspicious links." Specific examples stick; generic warnings don't.

11. There's a plan — written down, not just understood — for what happens in the first hour after a suspected breach. Who gets called, what gets disconnected, who talks to customers. Deciding this during an actual incident costs time you don't have.

12. Someone outside your own team has actually looked at your security setup in the last year. It's hard to see your own blind spots from the inside — a second set of eyes catches what internal familiarity misses.

Why October Specifically

The timing isn't arbitrary. The months right after Awareness Month are also when year-end financial transactions ramp up and staff attention shifts toward the holidays — exactly the combination that makes a moment of inattention more consequential. Closing gaps now, before that stretch begins, is more useful than closing them after.

What To Do With This List

If you checked every box, you're in better shape than most small businesses — genuinely. If you didn't, don't try to fix all twelve at once. Start with whichever unchecked item would hurt the most if exploited tomorrow, usually backups or multi-factor authentication, and work down from there.

A free technology assessment walks through exactly this list against your actual systems — not a generic scan, an honest look at which of these twelve gaps you actually have and what closing them would cost.

Layth Solutions provides 24/7 monitoring, cybersecurity, and managed IT support for small and mid-sized businesses across New York, New Jersey, Pennsylvania, and Connecticut.