Most checklists are forty items long, unordered, and abandoned at item six. This one is twelve, ordered by risk removed, and the first eight cost nothing but time.
You do not need a security programme to be meaningfully safer than you were last month. You need the first few items on a list that is in the right order.
Costs nothing but an afternoon
- Enforce MFA on every account, including administrators and any shared mailbox that can sign in.
- Block legacy authentication, or the protocols that bypass MFA remain open.
- Publish SPF, DKIM and DMARC, and move DMARC to enforcement once reports confirm nothing legitimate is caught. This stops your domain being forged.
- Remove accounts belonging to people who have left. Every business has at least one.
- Remove local administrator rights from everyday accounts.
- Turn on unified audit logging, so an investigation has something to read.
- Stop users consenting to third-party apps reaching company mail.
- Check for mailbox forwarding rules nobody created.
Costs money, and is worth it
- Backup with retention and immutability, restore-tested rather than assumed.
- Endpoint detection and response, not just bundled antivirus.
- A business-grade firewall with a maintained subscription, if what you have is a consumer router.
- Security awareness training, delivered and recorded.
If you do only the first three, you have removed a large share of the risk that actually materialises for small businesses — credential theft, domain impersonation and MFA bypass. None of them requires buying anything.
How to check the third one right now
Email authentication is the one item on this list you can verify yourself in seconds. Put your domain into the free email security check on this site. It reads the same public records every mail server reads, and tells you whether somebody can send email pretending to be you.
We measured this across independent Ocala and Marion County businesses and the large majority were exposed. If yours comes back clean, that item is done and you can move to the next one.
What is deliberately not on this list
- A password policy requiring quarterly changes. Current guidance is against it — forced rotation produces predictable passwords.
- Blanket USB blocking. Occasionally right, more often a large amount of friction for a small amount of risk.
- Anything sold as AI-powered without a description of what it actually does.
Frequently asked
Can we do these ourselves?
The first eight, largely yes, with a competent person and admin access. The DNS records and Conditional Access design are where a mistake is most costly — tighten the wrong record first and your real email stops being delivered.
How long should this take?
For a business under twenty people with Microsoft 365, the free items are a focused day or two. The DMARC enforcement step needs a couple of weeks of monitoring in between, and that wait is the part people skip.
What if we have no IT person?
Then start with MFA and the email records, because those remove the most risk per hour of effort. Neither requires ongoing management once done.