The San Diego Small Business Cybersecurity Checklist

Most cybersecurity advice aimed at small businesses is either written by someone selling a product or so generic that it is impossible to act on. This is the list I actually give people when they stop me after a talk or a TV segment.

It is ordered deliberately. The items near the top prevent the incidents I see most often. The items near the bottom matter, but they will not save you if the top of the list is undone.

Start here: the accounts, not the computers

Small businesses tend to imagine cybersecurity as antivirus software on a laptop. In practice, the overwhelming majority of incidents I see start with someone logging into an account they should not have access to.

Turn on multi-factor authentication for email first. Your email account is the master key to your business. Anyone who controls it can trigger password resets on your bank, your payroll provider, your domain registrar, and your accounting software. Protect it before anything else.

Then extend MFA to everything that touches money or data. Banking, payroll, accounting, your domain registrar, cloud storage, and any remote access into your network.

Prefer an app or a hardware key over text-message codes. SMS codes can be intercepted through SIM-swapping. They are still far better than nothing — if SMS is the only option a vendor offers, use it rather than skipping MFA entirely.

Get a password manager for the whole team. Reused passwords are how a breach at an unrelated website becomes a breach at your company. A password manager makes unique passwords the path of least resistance instead of a chore.

Assume something will go wrong

Back up, then verify the backup restores. An untested backup is a hope, not a control. Restore a file from it this month. Ransomware planning is really backup planning.

Keep at least one backup copy offline or otherwise out of reach. Modern ransomware operators look for connected backups and encrypt those too. A backup that your everyday admin account can delete is a backup an attacker can delete.

Write down who to call. One page: your IT provider, your insurance broker, your attorney, your bank’s fraud line. When something happens at 6pm on a Friday, nobody wants to be searching for phone numbers. See the first 24 hours after a breach for what to do with that list.

Close the ordinary gaps

Patch promptly, especially anything exposed to the internet. Firewalls, VPN appliances, and remote access tools are prime targets precisely because they are reachable from anywhere. Turn on automatic updates wherever you reasonably can.

Remove access the day someone leaves. Offboarding is a security control. Former employees, former contractors, and the vendor you stopped using two years ago should not still have logins.

Give people the access they need and no more. Not everyone needs to be an administrator. The blast radius of a compromised account is defined by what that account could reach.

Configure email authentication for your domain. SPF, DKIM, and DMARC make it meaningfully harder for someone to send mail that appears to come from your business. Your IT provider or email host can set this up; it is a configuration change, not a purchase.

The control that stops the most expensive fraud

Verify payment changes by phone, using a number you already had. If an email asks you to update bank details on an invoice or change where payroll is deposited, call the person back on a number from your own records — never the number in the email.

This one habit prevents the category of loss that hurts small businesses most, and it costs nothing. Wire fraud and invoice fraud do not require the attacker to break anything technical. They require you to believe a message.

Then, and only then, consider the extras

Once the above is genuinely in place, additional measures start to earn their keep: endpoint detection tools, security awareness training, a formal written policy, cyber insurance, and eventually an actual penetration test.

I list these last on purpose. I have reviewed environments that had an expensive security product installed and no multi-factor authentication on email. That is a business that spent money without reducing risk.

What about AI tools?

If your staff have started using AI assistants at work — and they almost certainly have, whether or not it was sanctioned — that introduces a genuinely new set of questions about what data leaves your business. I have written that up separately in the AI security guide for small business.

A note on local resources

San Diego has an unusually active security community, and much of it is free. OWASP San Diego meets regularly and is open to anyone. If you want to understand this material better rather than simply buy it, showing up is a reasonable first step.