Cybersecurity checklist for small service businesses

Small service businesses hold exactly the data attackers want: client contact details, financial records, health information, case files and login access to bank accounts. A checklist turns security from a vague worry into a short list of settings and habits your team can finish and check off.

Size does not keep a business off the target list. Verizon's 2025 Data Breach Investigations Report SMB snapshot, which defines smaller organizations as those with fewer than 1,000 employees, found ransomware present in 88% of breaches at those organizations, compared with 39% at large ones. The same snapshot found that use of stolen credentials was the top hacking method, involved in 33% of smaller-organization breaches.

The checklist below follows guidance from the Federal Trade Commission's cybersecurity basics for small business and other public sources. It is written for teams without a dedicated IT department. If you work in health care, legal, accounting or insurance, you may also have industry rules (such as HIPAA or state data security laws) that require more.

Multi-factor authentication (MFA) requires a second proof of identity, such as a code from an app or a security key, in addition to a password. It is the single most effective step on this list. A 2023 Microsoft Research study of accounts on its platform found that MFA reduced the risk of compromise by 99.22% across the population studied, and by 98.56% even for accounts whose passwords had already leaked.

Start with the accounts that would hurt most if someone else got in.

• Email accounts (Google Workspace or Microsoft 365), including admin accounts
• Banking, payroll and payment processor accounts
• Accounting, CRM, practice management and client portal software
• Domain registrar, website hosting and DNS accounts
• Social media and Google Business Profile
• Prefer an authenticator app, passkeys or a hardware key over text message codes where the service supports them
• Require MFA for all staff through your admin console, not as an optional setting

A password manager lets every person use long, unique passwords without memorizing them, and lets you share logins with the team without sending them by text or email. Business plans from 1Password, Bitwarden, Keeper and Dashlane include shared vaults and admin controls.

Set a short policy that matches current federal guidance. NIST's Digital Identity Guidelines (SP 800-63B) say passwords used on their own should be at least 15 characters, that systems should not force composition rules like mixed symbols, and that people should not be required to change passwords on a schedule unless there is evidence of compromise. Length and uniqueness matter more than complexity.

• Every staff member has a password manager account managed by the business
• No password is reused across two services
• Shared logins live in shared vaults with access limited to who needs them
• Passwords are changed right away if an account may have been exposed

Updates fix security holes that attackers already know how to use, so turn on automatic updates for operating systems, browsers and apps. The FTC's small business guidance lists software updates first among its basics for protecting files and devices.

Cover every device that touches business data, including personal phones that receive work email. If staff use their own devices, set minimum requirements: a supported operating system, a screen lock, encryption turned on and the ability to remove business data if the device is lost.

• Automatic updates on for Windows, macOS, iOS and Android
• Browsers and plugins set to update automatically
• Retire devices that no longer receive security updates
• Screen lock and device encryption on every laptop and phone
• Antivirus or endpoint protection on every computer
• Office Wi-Fi uses WPA2 or WPA3, with the router's default admin password changed

Backups are what let you recover from ransomware, a lost laptop or an accidental deletion without paying anyone. The FTC recommends keeping backups separate from your main systems. A backup that sits on the same network, synced to the same account, can be encrypted or deleted along with everything else.

Know what your cloud tools do and do not back up. Many cloud apps keep your data available, but restoring a deleted mailbox or a corrupted file from weeks ago may require a separate backup service. Check each critical system and fill the gaps.

• List every system with data you cannot lose: email, files, accounting, CRM, practice or case management
• Automatic daily backups for each one
• At least one copy stored separately from the main system and account
• Restore test at least twice a year, timed, so you know how long recovery takes
• Backup admin access protected with MFA

Email is where most attacks start, so harden it and teach the team what a fake request looks like. Verizon's SMB snapshot found that social attacks, mostly phishing, were involved in 18% of breaches at smaller organizations. A common pattern in service businesses is a fake invoice or a request to change payment details that appears to come from a vendor, client or the owner.

Turn on the built-in protections in Google Workspace or Microsoft 365, and ask your domain host or website provider to set up email authentication records so others cannot easily send mail pretending to be you.

• SPF, DKIM and DMARC records set up for your domain
• Spam, malware and impersonation protection turned on in your email admin console
• External email warning banner turned on
• Rule: any request to change bank details or send money is confirmed by phone using a known number
• Short phishing training at onboarding and refreshers through the year
• One easy way for staff to report a suspicious message

Give each person access only to the systems and data they need, and remove it the day they leave. Former staff, contractors and agencies with active logins are an easy gap to miss, especially when accounts were set up informally.

Keep a simple access list for each person: which systems they use, what role they have and who approved it. Use it during offboarding so nothing is forgotten.

• Everyone has their own login; no shared admin accounts
• Admin rights limited to the fewest people possible
• Offboarding checklist: disable email, remove from every app, recover devices, rotate shared passwords
• Contractor and agency access reviewed when the project ends
• Business-critical accounts owned by a business email address, not a personal one

Your vendors hold your data too, so check them before you sign and review them once a year. Verizon's 2025 DBIR found that third-party involvement in breaches across all organizations doubled from 15% to 30%. For a service business, vendors include your CRM, booking system, payment processor, IT provider, marketing agency and any app connected to your email or files.

You do not need a long questionnaire. A few direct questions cover most of the risk.

• Does the vendor support MFA and single sign-on?
• Where is data stored, and is it encrypted?
• Will they sign a business associate agreement or data processing agreement if your industry needs one?
• How and when will they notify you of a breach?
• Can you export your data and close the account cleanly?
• Review apps connected to your Google or Microsoft account and remove ones you no longer use

An incident plan tells the team what to do in the first hour after something goes wrong, so nobody improvises under stress. The FTC lists having a plan for data backup, keeping the business running and notifying customers after a breach among its small business basics.

Keep the plan to one page, print a copy and store one outside your main systems, because you may not be able to log in when you need it.

Monvell sets up the platform side of this for service businesses, including account ownership, access controls and backups for the systems we build, and documents it so your team knows who to call.

• Who to call first: your IT provider, cyber insurance carrier and bank
• How to disconnect an affected device from the network without wiping it
• Where backups live and who can restore them
• How to reset passwords and revoke sessions for affected accounts
• Legal and client notification steps, including state breach notification rules
• Where to report: the FBI's Internet Crime Complaint Center (IC3) for fraud and cybercrime

If this list feels long, start with the five steps that close the most common gaps. Each one can be done in an afternoon by someone comfortable with your admin settings, or by your IT provider in a single visit. Do them in this order, then work through the rest of the checklist over the next few weeks.

• Turn on and require MFA for email and banking for every person on the team
• Set up a business password manager and move shared logins into it
• Confirm automatic updates are on for every computer and phone that gets work email
• Check that your most important data is backed up somewhere separate, then restore one file to prove it works
• Tell the team the payment-change rule: any request to change bank details or send money gets a phone call to a known number first
• Write down who to call if something goes wrong and put the list somewhere you can reach without your computer

Review the checklist once a year, and again whenever you add a major system, change IT providers or have a security scare. Assign one person to own it, even if the technical work is outsourced. Each review, confirm MFA is still required for everyone, check the access list against current staff, run a restore test and update the incident plan contacts.