blog single

A year end security checklist for small businesses

Security operations dashboard with access alerts

Published on:

December 5, 2024

TAG:

CYBERSECURITY

BY:

Edgeless Team

Read Time:

6 MIN READ

post detail

Most small business security incidents do not start with a sophisticated attack. They start with an account that was never closed, a password reused across services, a laptop that missed six months of updates or a backup that had never been restored. A year end review catches those conditions while the office is quiet and the calendar has room.

Accounts come first

List every account that can access company data or money. Email, banking, accounting, payroll, the website, the domain registrar, cloud hosting, social media, the CRM and any tool that stores customer files. For each one, record who has access and what role they hold.

Remove access for people who left, contractors whose work ended and shared logins that nobody owns. Shared logins are a common shortcut in small teams and a common cause of incidents, because they cannot be revoked for one person and they hide who did what.

Turn on multi factor authentication for email, banking and the domain registrar.
Remove departed staff and contractors from every system, not just email.
Replace shared logins with named accounts and roles.
Check that former employees cannot access the website or social accounts.
Review forwarding rules and inbox filters for anything unfamiliar.
Confirm the recovery email and phone number on every critical account.
Store recovery codes offline, not in a shared document.

Multi factor, done properly

Multi factor authentication is the single highest value control for most small businesses. Use an authenticator app or a hardware key for email and finance. SMS codes are better than nothing and weaker than app based codes because phone numbers can be moved to another device.

Protect the recovery path as carefully as the login. If an attacker can reset the password through the recovery email, the second factor on the original account is less useful. Keep the recovery email on a separate provider with its own strong password and second factor.

IT team reviewing account access across systems — A named account with a role is easier to audit and revoke than a shared login with a note in a spreadsheet.

Devices and updates

Check that operating systems, browsers and office software are set to install updates automatically. Confirm that disk encryption is on for every laptop, especially the ones that leave the office. Review who can install software, and remove tools that are no longer used.

Inventory the devices that connect to company systems. Personal phones used for email and messaging are part of the picture. Require a passcode, enable remote wipe and know how to remove company data from a personal device when someone leaves.

Vendors and access

Review the tools that hold customer data. For each one, ask what data it holds, who at the vendor can see it and what happens when the contract ends. Remove integrations that nobody uses, especially those created during a trial and never disconnected.

Check the access your vendors have to your systems. An agency with a personal login to your website should have a named account with the smallest role that works. When the engagement ends, remove the account rather than leaving it for convenience.

Backups you have tested

A backup that has never been restored is a hope. Pick one critical system and restore it to a test environment. Measure how long it takes and what is missing. Do the same for the website and the file share. The time to discover a broken backup is before an incident, not during one.

Follow the rule of three copies on two media with one off site, and keep at least one copy that ransomware cannot reach from a normal user account. An attacker who encrypts the file server should not be able to encrypt the backup as well because it is mounted on the same network.

The website itself

Websites are often the forgotten system in a security review. Check who has administrator access, remove old plugins and themes, confirm that forms send to a monitored inbox and review file upload paths. If the site runs a CMS, apply the latest security release and check that the admin area is not open to the public internet without a second factor.

Review the domain and DNS settings. Confirm that the registrar account is protected, that the registration is not about to expire and that nobody has added an unfamiliar mail record. A hijacked domain can redirect customers and intercept email, and recovery can take days.

Staff awareness

Most incidents that reach a person start with a message that looks urgent. Run a short session on payment change requests, unexpected attachments and links that ask for a login. Give people a simple way to report a suspicious message without fear of blame. Reporting speed matters more than perfect judgement.

Write down what to do in the first hour of a suspected incident: who to call, which accounts to disable, where the backups are and who talks to customers. A one page plan removes the worst decisions from the worst moment.

Run one short exercise each year. Pick a scenario, such as a lost laptop or a fake invoice email, and walk through the response with the people involved. The gaps that appear in a thirty minute exercise are far cheaper to fix than the same gaps discovered during a real event.

Passwords and a manager

A password manager removes the reason people reuse passwords. Give every employee a managed account with a shared vault for the few credentials that genuinely must be shared, and individual vaults for everything else. The manager also makes it easy to rotate a password when someone leaves or a vendor reports a breach.

Check the most reused passwords against a breach service and force a reset where needed. Set a minimum length rather than a complicated character rule, and let the manager generate long random values. A shared spreadsheet called passwords is the single most common finding in a small business review.

Insurance and records

If the business carries cyber insurance, read what the policy requires. Many policies ask for multi factor authentication, tested backups and a documented incident process. Meeting those conditions before a claim is far easier than arguing about them afterwards.

Keep a simple record of the review itself. The date, who checked which system and what changed. That record is useful for the next review and for any insurer, auditor or customer who asks how the business manages risk.

Security for a small business is mostly hygiene. Close the accounts, update the devices, test the backup and make the second factor routine.
Edgeless Team

Put the review on the calendar

The list is long because a year is a long time for access to drift. Split it across two afternoons and assign an owner for each section. Accounts and finance in the first session, devices, vendors and backups in the second.

Start with the systems that can lose money or send messages in your name. Email, banking and the domain registrar carry the most risk because a compromise there reaches customers and partners directly. A hacked social account is embarrassing. A hacked domain registrar can take the website and email offline at the same time.

Write the date for the next review before you finish. A review that happens once becomes a cleanup. A review that happens every year becomes a habit, and the list gets shorter each time because the same problems stop coming back.

We review website access, hosting, forms and integrations, then give your team a prioritized list of fixes with an owner for each.

Explore software development

None of these steps requires a large budget. They require a list, an owner and a couple of quiet afternoons. The businesses that do them are the ones that turn a serious incident into a minor one.

Security

Operations

Risk

A year end security checklist for small businesses

Let's Talk About Your Project