35-Point Cybersecurity Checklist for Small Business Businesses in Orange County (2026)

MFA requires a second verification step (phone code, authenticator app) beyond passwords, blocking 99% of account takeovers. Set up MFA immediately on email, cloud storage, financial software, and VPN access. This is the single most effective security control for small businesses.

Password managers like Bitwarden or 1Password eliminate weak password practices and reduce password reuse. Distribute secure shared passwords to employees without exposing them, and track password changes. This reduces phishing success rates significantly.

Create a written policy requiring passwords with uppercase, lowercase, numbers, and symbols. Enforce password changes every 90 days in your systems. Communicate the policy clearly to all staff and audit compliance quarterly.

Limit admin privileges to only IT staff and designated managers who need it. Use separate accounts for administrative tasks and daily work. This prevents malware from gaining full system control if an employee account is compromised.

Create an offboarding checklist that includes immediate account deactivation, laptop retrieval, and access removal from all systems. Former employees retain access to sensitive data if accounts remain active. Document this process and assign responsibility to a manager.

Review user access lists for all critical systems and remove permissions no longer needed for current roles. Document who has access to sensitive data, financial systems, and customer records. This prevents data leaks from overly permissive access.

Use tools like Microsoft Defender or Proofpoint to block phishing emails before they reach inboxes. These systems analyze links and attachments, flag suspicious senders, and prevent malware execution. This reduces successful phishing attacks by up to 95%.

Send fake phishing emails to employees to test awareness and track who clicks malicious links. Use tools like KnowBe4 or Gophish to automate this. Identify high-risk employees and provide targeted training immediately after each test.

Use platforms like Cybrary or LinkedIn Learning to deliver 30-45 minute security training covering phishing recognition, password hygiene, and social engineering. Track completion rates and require certification. New hires should complete training within their first week.

Document a step-by-step process for reporting suspected phishing, malware, or unusual account activity. Include a direct contact (email or phone) and assure employees there's no penalty for reporting. Make the process visible on your intranet or shared drive.

Tools like Crowdstrike or Microsoft Defender for Endpoint monitor devices for malware, suspicious behavior, and data exfiltration in real-time. This detects ransomware before it spreads across your network. EDR is essential for any business handling sensitive data.

Display posters about phishing recognition in break rooms and include security tips in monthly company emails. Reinforce behaviors like 'verify before clicking links' and 'never share passwords.' Consistent messaging increases awareness significantly.

Set up backup software (Veeam, Backblaze, or cloud-native solutions) to automatically back up files, databases, and systems daily. Test restore procedures monthly to confirm backups work. Store at least one backup copy offsite or in the cloud, disconnected from your network.

Maintain three copies of data: original, local backup, and offsite backup. Use different storage types (internal drives, external drives, cloud storage). This ensures you can recover from hardware failure, ransomware, or natural disaster.

Disconnect an external drive or offline storage device monthly and create a full backup, then store it securely. Ransomware cannot encrypt backups not connected to your network. Test restoration from this backup at least quarterly.

Write a one-page plan specifying how long each system can be down before impacting business (RTO—e.g., email: 2 hours, website: 4 hours). Include recovery steps, responsible staff, and contact information. Update this plan annually and after significant system changes.

Perform a complete restore of critical systems from backup in a test environment to ensure procedures work. Document issues and update recovery steps. This identifies gaps before you actually need to recover during an emergency.

Install or update a business-grade firewall (hardware or cloud-based) and configure rules to allow only necessary inbound traffic. Enable intrusion detection and block known malicious IP addresses. Review and update rules quarterly as your business needs change.

If you offer guest Wi-Fi, create a separate network that cannot access internal systems, printers, or file storage. Require a strong password changed monthly. Monitor guest network usage and disable access immediately if unauthorized activity is detected.

Set up a business VPN (OpenVPN, Cisco, or cloud-based) requiring encryption for all remote connections. Enable MFA on VPN access. Monitor VPN logs for unusual login patterns or failed authentication attempts that indicate account compromise.

Configure Windows, Mac, and all applications to auto-update weekly. Many breaches exploit unpatched vulnerabilities, so fast patching is critical. Test patches in a non-critical environment first if you have sensitive systems.

Use MDM software (Microsoft Intune, Jamf, or MobileIron) to enforce encryption, require PIN codes, enforce app whitelisting, and enable remote wipe if a device is lost. This protects company data accessed from mobile devices.

Enable BitLocker (Windows), FileVault (Mac), or equivalent on all devices. Encrypt external USB drives and shared storage. This prevents data theft if a device is stolen, which is common in busy Orange County business districts.

Deploy a Security Information and Event Management (SIEM) system or use a managed SOC service to monitor logs and network traffic for threats. This detects compromises in real-time and sends alerts. Many breaches go undetected for months without monitoring.

Determine if you need HIPAA (healthcare), CMMC (federal contractors), PCI-DSS (payment processing), or SOC 2 (service providers). Review client contracts and regulatory requirements. Document your compliance obligations in writing.

List all types of sensitive data (customer records, payment info, health data, IP) and where it's stored (servers, cloud, endpoints). Categorize by sensitivity level. This is required for HIPAA, PCI-DSS, and CMMC compliance.

Define how long you keep customer data, employee records, and backups before securely deleting them. Specify deletion methods (secure wiping for drives, shredding for paper). Document this policy and train staff. This reduces breach impact and improves compliance.

Create written policies covering password requirements, acceptable use, remote work security, device handling, and incident reporting. Have employees sign acknowledgment of these policies. This establishes accountability and supports compliance audits.

Evaluate your current security controls against threats and compliance requirements. Identify gaps and prioritize remediation. Document findings and corrective actions. Many compliance standards require documented annual assessments.

Record date, time, description, impact, and remediation for any suspected or confirmed security incidents. Keep this log confidential and retain for at least 3 years. This demonstrates due diligence during compliance audits and potential legal proceedings.

Hire a qualified third-party cybersecurity firm to audit your controls, test vulnerabilities, and verify compliance. Use findings to update your security roadmap. This is often required for HIPAA, PCI-DSS, and CMMC compliance.

Before adopting new tools, verify the vendor has security certifications (SOC 2, ISO 27001), data encryption, and breach notification policies. Ask for their security documentation. Document vendor security profiles and reassess annually.

A DPA specifies how the vendor will protect your data, handle breaches, and comply with regulations like HIPAA or GDPR. Use a standard template and have legal review it. This is required for compliance in many industries.

Review access permissions for all contractors, consultants, and vendor representatives. Remove any unnecessary access to files, databases, or administrative functions. Document who has access and rotate credentials regularly.

Subscribe to vendor security alerts and review breach notifications immediately. If a vendor is breached, assess if your data was exposed and take action (password changes, notification). Document incidents and vendor responses.