Resources
Free tools and a checklist you can act on today
No email address required and nothing gated. If it is useful, it should be usable.
Checklist
The small-business security baseline
Ten controls, in roughly the order worth doing them. Ordered by risk reduced per dollar spent, not by what is easiest to sell.
- 1
Turn on multi-factor authentication everywhere
HoursEmail first, then remote access and anything financial. This single control stops the overwhelming majority of account takeovers, and it is free with Microsoft 365.
- 2
Lock your domain against spoofing
DaysPublish SPF, DKIM and DMARC so criminals cannot send email that appears to come from your business. Do it in stages so your real mail keeps delivering.
- 3
Prove a restore actually works
HoursDo not check that backups ran — restore something and open it. A backup nobody has restored from is an assumption, and the failure rate is far higher than people expect.
- 4
Keep one backup copy an attacker cannot delete
DaysRansomware now goes for the backups first, using the admin credentials it stole. An immutable copy is the difference between an incident and a catastrophe.
- 5
Patch on a schedule, and check it happened
OngoingOperating systems and third-party applications, on a defined cadence, with a report showing compliance. 'Automatic updates are on' is not evidence.
- 6
Remove access the day somebody leaves
HoursAccounts belonging to former staff are a standing risk and an audit finding. Make offboarding a checklist somebody owns.
- 7
Separate guest WiFi from the business network
DaysDifferent password is not separation. Guests, cameras and payment systems should be unable to reach your servers at the network level.
- 8
Stop mailbox auto-forwarding
MinutesAttackers who compromise a mailbox set a quiet forwarding rule and watch for months. Blocking external auto-forwarding at the tenant level closes it.
- 9
Write down what happens during an incident
HoursWho is called, in what order, and what gets disconnected. One page is enough. Deciding under pressure is how small incidents become large ones.
- 10
Review who has administrator rights
HoursUsually more people than anyone expects, often including a former provider. Reduce it to the minimum and review it quarterly.
Working through this list yourself is a perfectly reasonable plan, and we would rather you did it than not. If you would like somebody to do it with you, that is what the free assessment is for.
Ready to secure your business?
A free assessment: we review your network, backups, Microsoft 365 settings and exposure, then hand you the findings in writing — whether or not you hire us.