Small-Business Security Checklist: Score & Action Plan

Accounts and passwords Everyone uses a password managerPasswords are generated, unique per account and never kept in a spreadsheet or on sticky notes. No password is shared or reusedShared accounts use the manager’s sharing feature, not a password sent by email or chat. A written password policy existsLength, MFA, storage and what to do after a leak. Draft one with the policy builder. Passwords were audited this yearReused and breached passwords found and changed, for example with the password audit.

Multi-factor authentication MFA is on for every email accountWhoever controls an inbox can reset every other password. MFA protects banking, payroll and accountingPrefer an authenticator app, passkey or security key over SMS. See the 2FA guide. Admin accounts are separate and protectedDay-to-day work uses a normal account; administrator rights have their own login with MFA.

People Access is removed the day someone leavesA written list of accounts to disable, shared passwords to change and devices to recover. Staff know how to spot phishingTry the phishing quiz together once a year. Payment changes are verified by phoneNew bank details or urgent transfers are confirmed on a number you already know.

Devices and data Automatic updates are onComputers, phones, browsers, the router and the website’s software. Backups are automatic and testedAt least one copy is offline or immutable, and a restore was tested in the last six months. Laptops and phones are encrypted and lockedBitLocker, FileVault or the phone’s built-in encryption, with a screen lock. Guests use a separate Wi-Fi networkWith its own strong password. Make a guest Wi-Fi card.

Incidents Everyone knows who to call after a mistakeA named contact and a one-page plan: change passwords, revoke sessions, warn clients if needed. Incidents are written downA simple register of what happened and what was done. In Quebec, Law 25 requires one: read our Law 25 guide.

Checklist FAQ

Where are my answers saved?

Only in this browser, so you can come back later. They are never sent to us. Use Reset to clear them, or a private window if you share the computer.

How is the score calculated?

Each measure has a weight from 1 to 3 according to how much risk it removes. High-priority measures, such as MFA on email and removing departed staff, count three times more than nice-to-haves.

Is this a compliance assessment?

No. It is a practical self-check of common account-security measures. It does not replace an audit or legal advice, for example on Quebec’s Law 25 or PCI DSS.

How often should we redo it?

Every quarter, and whenever someone joins or leaves, you change a key tool, or an account is compromised.

5 minutes · Printable plan
How secure is
your business?

Checklist FAQ

More free security tools

Password generator

Passphrase generator

Wi-Fi password + QR code

Strength test

Breach checker

Suspicious link checker

Password policy builder

Crack-time table

Password audit

Custom-rules generator

Phishing quiz

Two-factor authentication guide

5 minutes · Printable planHow secure isyour business?

Checklist FAQ

More free security tools

Password generator

Passphrase generator

Wi-Fi password + QR code

Strength test

Breach checker

Suspicious link checker

Password policy builder

Crack-time table

Password audit

Custom-rules generator

Phishing quiz

Two-factor authentication guide

5 minutes · Printable plan
How secure is
your business?