Key Takeaways
- Most small business break-ins start with a stolen password or a fake email, not a clever hack.
- Multi-factor sign-in on email and remote access blocks a large share of everyday attacks.
- A backup you have never test-restored is a hope, not a backup.
- Write down who does what when something goes wrong before it does.
- You can finish most of this list in a few weeks without buying a pile of new tools.
If you run a small office in Atlanta, you probably do not have time to read security reports. You just want to know what to check. This list gives you 20 items, in plain English, that cover the most common ways small businesses get hurt. You do not need to be technical to work through it. You only need a pen, an hour or two, and the willingness to ask a few direct questions of whoever looks after your computers.
Attackers do not pick on you personally. They send the same fake invoice to thousands of businesses and wait for someone to click. A dental office in Decatur, a law firm in Midtown and a contractor in Alpharetta all look the same to an automated scam. That is why basic habits matter more than expensive gear. The checks below are the habits. If you would rather hand the whole job to a team, cyber security services in Atlanta cover these items for a steady monthly fee.
Go through the list in order. Mark each item Done, Partly or Not Yet. Be honest. A Partly is usually the most dangerous answer, because it feels safe. At the end, you will have a short list of gaps ranked by how much trouble they can cause, and you will know which ones to fix first.
How to Use This Checklist
Print the list or copy it into a shared document. Give each item an owner and a date. An item with no name next to it does not get done. In a ten-person office, the owner is often the office manager, a partner or the one staff member who is good with computers. That is fine, as long as that person has the time and the authority to act.
Work in this order: accounts first, then email, then devices, then backups, then people and paperwork. The order matters because attackers go after accounts and email far more often than they go after your network equipment. Fixing the front door before the back window is not glamorous, but it works.
- Mark every item Done, Partly or Not Yet.
- Give each gap one owner and one date.
- Recheck the whole list every six months, or after a staff change or office move.
- Keep your answers in a file you can show an insurer or a client who asks.
A checklist with a name and a date next to each gap gets finished far more often than one that sits in a folder.
Accounts & Passwords (Items 1 to 5)
Stolen logins cause more small business damage than any other single problem. People reuse passwords, and criminals buy lists of leaked ones. If your staff use the same password at work that they used on a shopping site that was breached years ago, an attacker may already hold the key to your email.
- 1. Turn on multi-factor sign-in. Require a second step, such as a code on a phone, for email, remote access and any system that holds client or financial data. Start with the owner and anyone who handles money.
- 2. Use a password manager. Give every person a manager so they can use long, unique passwords without memorizing them. Retire the sticky note under the keyboard.
- 3. Remove shared logins. If three people share one account, you cannot tell who did what. Give each person their own, with only the access their job needs.
- 4. Limit administrator rights. Daily work should not run on an account that can install software or change settings. Keep admin accounts separate and few.
- 5. Close accounts the day someone leaves. Disable email, remote access and software logins on the final day. Old accounts are a favorite way in.
Item 4 surprises many owners. When a staff member with full admin rights clicks a bad link, the damage spreads much farther than it would from an ordinary account. Taking away unneeded rights costs nothing and shrinks the problem.
A single phone prompt at sign-in stops most attacks that rely on a stolen password alone.
Email & Phishing Defenses (Items 6 to 9)
Email is where most attacks begin. A fake invoice, a fake delivery notice or a message that looks like it came from your own boss can all lead to a bad click. Good filtering catches a lot of this. Trained staff catch much of the rest.
- 6. Turn on spam and malware filtering. Your email service has stronger settings than the defaults. Make sure attachments and links are scanned before they reach an inbox.
- 7. Flag outside senders. Add a visible tag to messages from outside your company. It makes a fake message from the boss easier to spot.
- 8. Set a payment confirmation rule. Any change to bank details or any wire request must be confirmed by phone, using a number you already have. Never use the number in the email.
- 9. Train staff a few times a year. Short, regular lessons beat one long annual session. Include real examples, such as the fake invoices and package notices your own staff receive.
Item 8 is the one that saves real money. Business email fraud often targets bookkeepers and office managers who are busy and trying to be helpful. A calm rule that says we always call to confirm gives them permission to slow down. Read more about building that habit in security awareness training.
A fake invoice that looks like it came from a known vendor is one of the most common scams aimed at small offices.
Devices, Updates & Network (Items 10 to 14)
Every laptop, phone and printer is a door. Doors need locks, and locks need updating. Most successful attacks use flaws for which a fix already exists. The business simply never installed it.
- 10. Keep a device list. Write down every computer, phone, tablet and server, who uses it, and when it was bought. You cannot protect what you have not counted.
- 11. Install updates automatically. Turn on automatic updates for operating systems and common programs. Check monthly that they actually ran.
- 12. Use endpoint protection. Run a managed security program on every computer, not just free antivirus that nobody watches.
- 13. Encrypt laptops and phones. If a laptop is left in a car in Buckhead or on a MARTA train, encryption keeps the data unreadable.
- 14. Secure the Wi-Fi. Use a strong password, keep guests on a separate network and change the router’s default login.
Not sure what is actually on your network? A vulnerability scan lists the weak spots on your devices and equipment so you can fix the worst first. It is a good way to check items 10 to 14 against reality instead of memory.
Changing the default administrator login on a router takes a few minutes and closes a door attackers try first.
Backups & Recovery (Items 15 to 17)
Backups are what let you shrug off ransomware, a failed drive or an accidental deletion. But a backup that has never been restored is a guess. Many owners find out it was not working on the worst possible day.
- 15. Follow the 3-2-1 idea. Keep three copies of your data, on two kinds of storage, with one copy off site or in the cloud and out of reach of your main network.
- 16. Back up cloud email and files too. Microsoft 365 and Google do not keep your data forever the way many people assume. Back it up separately.
- 17. Test a restore every quarter. Pick a file and a folder, restore them, and time it. Write down how long it took and who did it.
| Question | If the answer is yes | If the answer is no |
|---|---|---|
| Is a copy kept away from your main network? | Ransomware is less likely to reach it | Attackers may encrypt it along with everything else |
| Have you restored a file in the past 90 days? | You know the process works | You may not find out until you need it |
| Are cloud email and files backed up separately? | Deleted or damaged data can be recovered | Recovery may be limited or impossible |
| Do you know how long a full restore takes? | You can plan around it | Downtime could run far longer than expected |
People, Paperwork & Planning (Items 18 to 20)
The last three items are about preparation. Technology fails, people make mistakes and sooner or later something goes wrong. Offices that recover quickly are the ones that decided what to do before the problem showed up.
- 18. Write a short response plan. One page: who to call first, who can shut off access, who talks to clients and which phone numbers work if email is down. Print it.
- 19. Review vendor and software access. List outside companies that can reach your systems, such as your accountant’s portal, a billing program or a former IT contractor. Remove what you no longer use.
- 20. Check your cyber insurance answers. Insurers ask whether you use multi-factor sign-in, backups and training. Make sure what you told them is still true.
For item 18, many small offices find it helpful to work through a real scenario with an expert. A short session with a cybersecurity consultant can turn a blank page into a working plan in an afternoon. And if you want someone to test whether the doors you locked really hold, penetration testing attempts a controlled break-in and reports what it finds.
Do It Yourself or Get Help
Plenty of owners can finish items 1 to 9 on their own. The harder part is staying on top of items 10 to 17 month after month. Updates fail quietly, backups stop without warning and new hires arrive with no training. That is where a steady, monitored approach pays off.
| Do It Yourself | Stack Atlanta | Single IT Contractor | |
|---|---|---|---|
| Cost | Your time, plus tool subscriptions | One monthly fee, quoted in writing | Hourly, hard to predict |
| Monitoring | Whenever you remember | Continuous, with alerts reviewed by people | Usually only when called |
| Backup testing | Often skipped | Done on a schedule and reported | Depends on the person |
| Staff training | Self-guided | Regular, with real examples | Rarely included |
| Coverage if one person is out | None | A team covers the gap | Often none |
If you want ongoing coverage rather than a one-time cleanup, managed security services bundle monitoring, protection and response into one plan. For a sense of what that costs, see managed security services cost in Atlanta. Spending on testing instead? Penetration testing costs in Atlanta vary with size and scope, and the guide explains why.
No office finishes all 20 items in a day, and nobody expects that. What matters is that you know where you stand. Start with accounts and email, since those close the doors attackers use most. Then move on to updates, backups and your written plan. Each item you complete makes a real attack harder and a bad day shorter.
If you would like a second pair of eyes, Stack Atlanta offers a free IT assessment. We walk through this list with you, tell you plainly what we find and give you a written quote for anything that needs fixing. There is no pressure and no jargon. Just a clear picture of where your business stands today.
FAQs
How often should a small business review its cybersecurity checklist?
Review it every six months at minimum. Also run through it when someone joins or leaves, when you add a new system or when you move offices. Small changes often open gaps that nobody notices until an audit or an incident.
What is the single most important item on the list?
Multi-factor sign-in on email is usually the biggest win. Email is the main entry point, and a second step at login stops most attacks that rely on a stolen password. It is quick to set up and costs little.
Do I need special software to follow this checklist?
Not for most items. Many are habits and settings you already have access to, such as updates, account removal and payment confirmation rules. A password manager and managed endpoint protection are the two tools most offices end up adding.
Is a small Atlanta business really a target for hackers?
Yes. Attacks are automated and sent to huge lists of businesses at once. Size does not protect you. Smaller offices are often hit harder because they have fewer safeguards and less time to recover.
Can I do this myself, or do I need an IT company?
Many owners can complete the first several items alone. The ongoing work, such as monitoring, patching and testing backups, is easier with help. A free assessment can show which parts you can handle and which are worth handing off.
Marcus Ellison
Editorial Director, Stack Atlanta
Marcus leads the Stack Atlanta editorial team and works with our technicians to turn real tickets, office moves and security reviews into practical guides for Atlanta business owners. He grew up in Atlanta and has spent more than 15 years in IT services, starting on a help desk in Midtown and later running network and support projects for law firms, clinics, logistics companies and fintech startups around the Perimeter. He holds Microsoft 365 and CompTIA Security+ certifications. Lately his focus is on how AI tools such as Microsoft Copilot can save small teams real hours without exposing client data, and every guide he writes is checked by a working technician before it is published.