A business cybersecurity checklist for 2026 covers seven areas: accounts and MFA, devices and updates, email and staff, backups, the network, vendors and cloud apps, and an incident plan. If you only do five things this quarter, make them MFA on email, automatic patching, endpoint detection and response, tested offline backups and phone verification for payment changes.
This is the checklist we'd hand a business or local government office in 2026. You don't need to finish it in a week. Work top to bottom: the sections are roughly in order of how often each one turns out to be the thing that would have prevented a real incident. CISA's Cyber Essentials covers the same ground for leaders who want the government's version.
What's different in 2026
Three things have changed the math for small organizations. First, AI has made phishing cheap, fluent, and personalized, so "spot the bad grammar" is no longer a defense. Second, cyber insurance carriers now routinely require proof of MFA, EDR, and tested backups before they'll write or renew a policy. Third, attackers have shifted toward the smallest targets precisely because they expect the basics below to be missing. The list itself isn't exotic — the stakes for skipping it are just higher.
1. Accounts and access
Most breaches still start with a stolen or guessed password, which is why this section comes first.
- Turn on multi-factor authentication (MFA) everywhere it exists — email, banking, payroll, Microsoft 365 or Google Workspace, and any remote access. Start with email; it's the master key to everything else.
- Deploy a password manager for the whole team and retire the shared spreadsheet of passwords for good.
- Remove admin rights from daily-use accounts. People can still request installs — malware just can't ride along on their permissions.
- Write down an offboarding step: when someone leaves, their accounts are disabled the same day, including email forwarding rules and any shared logins they knew.
- Audit who has access to what once a quarter. Access tends to accumulate; it should expire. Identity and access management makes this a report rather than a project.
2. Devices and updates
Devices are where work happens and where attacks land. The goal is simple: every machine known, current, and protected — automatically.
- Keep a current inventory of every computer, server, and phone that touches company data. You can't protect what you don't know you own.
- Automate updates for operating systems and third-party apps — browsers, PDF readers, Java, Zoom. Attackers love the apps nobody remembers to update. This is exactly what managed patch management automates.
- Run modern protection on every endpoint — next-gen antivirus paired with endpoint detection and response (EDR), not a consumer antivirus from 2019. Here's what managed endpoint security covers.
- Encrypt every laptop and keep the recovery keys somewhere other than the laptop (BitLocker on Windows, FileVault on Mac) so a stolen bag isn't a data breach. Managed device encryption handles the keys and the proof.
- Enforce screen locks and passcodes on phones that receive company email — and make sure someone can wipe a lost device remotely.
3. Email and the human layer
Phishing remains the most common way in — and in 2026, AI-written phishing emails no longer have the telltale typos.
- Run short, regular security awareness training. A few minutes each month beats an annual hour everyone forgets.
- Set a verification rule for money and credentials: any request to change payment details, buy gift cards, or share a password gets confirmed by phone at a known number. No exceptions, including requests that appear to come from the owner. This one rule is the main defense against business email compromise.
- Publish SPF, DKIM, and DMARC records for your domain so criminals can't easily send email as you.
- Add an external-sender banner to inbound mail so spoofed "internal" messages stand out.
4. Backups and recovery
Backups are the difference between ransomware being a bad week and being a business-ending event.
- Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one off-site or in a separate cloud.
- Back up Microsoft 365 / Google Workspace separately. The provider keeps the service running; retaining your deleted data is your job.
- Test a restore every quarter and time it. A backup you've never restored is a hope, not a plan — managed backup and disaster recovery builds that testing in.
- Keep at least one backup copy offline or immutable so ransomware can't encrypt the backups along with everything else.
5. Network and Wi-Fi
The network layer is invisible until it isn't. A few settings here remove the easiest ways in.
- Change default passwords on routers, firewalls, and printers — yes, printers.
- Keep firewall and router firmware updated. These devices are patched even less often than PCs, and they face the internet directly.
- Separate guest Wi-Fi from business Wi-Fi. Visitors' devices should never share a network with your file server or point of sale.
- Use a VPN or secure gateway for remote access instead of exposing remote desktop to the internet — exposed RDP is still a top ransomware entry point.
6. Vendors and cloud apps
Most businesses now run on a dozen cloud services, and each one is a door with its own lock.
- List every cloud app that holds company data: accounting, payroll, CRM, file sharing, the website host. Note who the admin is for each.
- Turn on MFA for every admin account in those apps, not just email. A payroll admin login is worth as much to an attacker as the owner's mailbox.
- Remove leavers from every app, not just Microsoft 365 or Google. The list above is what makes that possible.
- Know which vendors can reach your systems, including your IT provider's remote tools, and ask how their own access is protected.
7. Incident plan and cyber insurance
When something goes wrong, the first hour decides how bad it gets. Decide that hour now.
- Write a one-page incident plan: who to call, in what order, and where the cyber-insurance policy lives. Print it; if it only exists on the server, it may be encrypted too.
- Know your insurer's requirements. Renewal questionnaires ask about MFA, EDR, backups and training, and a claim can be challenged if the answers were wrong. Cyber insurance readiness means having evidence for each answer.
- Know how to report. Fraud and ransomware go to the FBI at ic3.gov; your bank needs a call within minutes if money has moved.
- Run a 30-minute tabletop once a year: walk through "the bookkeeper's mailbox was taken over" and see where the plan breaks.
How often should you review this checklist?
Quarterly for the items that drift: access reviews, restore tests, the cloud app list and patch status. Annually for the plan, the insurance questionnaire and the training program. And immediately after any change in staff, a new cloud app or a near miss. Put a name next to each item and a recurring review on the calendar; a checklist with no owner is a document, not a control.
If you do nothing else this quarter
The full list is worth working through, but five items prevent the most damage per hour invested:
- MFA on email and banking
- Automated patching for operating systems and third-party apps
- EDR-grade endpoint protection on every machine
- A tested backup with one copy off-site and offline
- The phone-verification rule for payments and credentials
Security isn't a product you buy once; it's a short list of habits kept current. If several of these items keep slipping, that is one of the signs your business has outgrown its IT setup.
If you'd rather have most of this handled for you, monitored, patched, backed up and reported on, that's what our managed IT services are built to do. Our free cyber insurance gap check runs your current setup against the questions insurers ask.
Frequently asked questions
What should be on a business cybersecurity checklist?
MFA on every account, automatic updates for operating systems and apps, endpoint detection and response, encrypted laptops, email authentication and staff training, tested offline backups, a separated guest network, a list of cloud apps and their admins, and a one-page incident plan.
What is the most important cybersecurity step for a business?
Multi-factor authentication on email. Email is the reset path for almost every other account, so a stolen email password without MFA hands an attacker the rest of the business.
Do businesses really get targeted?
Yes. Attackers run automated campaigns against anyone with an email address and an internet connection, and businesses with thin IT coverage are attractive precisely because they tend to have fewer controls and fewer people checking payments.
Can a business do this without an IT department?
Much of it, yes: MFA, a password manager, automatic updates and the payment verification rule need no specialist. Endpoint detection, monitored backups and patch reporting are where a managed IT provider usually earns its keep.
The Cyber-Insurance Questionnaire Gap Check
Covers MFA, endpoint protection, backups, email security, incident response and training. Each question comes with the evidence an underwriter expects to see.