01
MFA is on for every important account
Check email admin accounts, banking/payment accounts, domain registrar, website hosting, social accounts, cloud storage, password manager, and accounting tools.
Free self-check
Read this before you buy anything.
A plain-language 12-question self-check for small businesses that do not have a full-time IT or security person. No download required.
This is not a security audit. Nothing is tested, scanned, attacked, or verified by a third party. The questions help you notice where the business may need a clearer owner or next step.
The 12 questions
02
Admin accounts are separate from daily-use accounts
Check whether admin accounts are used for normal email and browsing, whether old admin users exist, and whether more than one trusted person can recover the business.
03
Passwords are in a real password manager
No shared passwords in spreadsheets, text files, email threads, or chat apps. Each person should have their own login where possible.
04
Backups exist and have been tested
Know what gets backed up, where it backs up to, who gets alerts if backup fails, and when the last restore test happened.
05
Devices are patched
Check operating systems, browsers, common business apps, router firmware, and any NAS or server firmware.
06
Endpoint protection is active
Check that Defender or equivalent is running, alerts are not ignored, and staff know who to contact if they see a warning.
07
Email protections are not ignored
Check SPF, DKIM, and DMARC for the domain, phishing reporting habits, and out-of-band verification for payment changes.
08
Critical vendors are known
List email, website hosting, domain registrar, payments, accounting, cloud storage, CRM, and IT provider if any.
09
Offboarding is not improvised
Can you remove a departing contractor from email, cloud storage, social media, website, and finance tools in one sitting?
10
Incident response has an owner
Know who decides what to do, who calls the bank, who contacts clients if needed, and where the recovery checklist lives if email is down.
11
Devices and accounts are inventoried
Track staff devices, shared devices, phones with business access, admin accounts, and software subscriptions.
12
You have a 30-day cleanup list
Pick the biggest three fixes instead of trying to fix everything at once.
If this was useful
Email the question number that made you pause. No pitch required.