A small business cybersecurity checklist should cover eight things: multi-factor sign-in, supported and updated software, tested backups, staff training, limited admin access, a secured network, a written response plan, and your cyber insurance requirements. People are the common thread. According to Verizon’s 2026 Data Breach Investigations Report, 62% of breaches involve a human element, like a clicked link or a reused password.
- Turn on multi-factor sign-in
- Keep every computer on supported, updated software
- Back up your data and test the restore
- Train your team to spot fake emails
- Limit who has admin access
- Separate your guest Wi-Fi
- Write down what happens when something goes wrong
- Match your setup to your cyber insurance policy
Are small businesses in Tennessee and Alabama really targets?
Yes, and the losses are local. According to the FBI’s 2025 Internet Crime Report, people and businesses in Tennessee reported $269 million in internet crime losses in 2025, across 16,261 complaints. Alabama reported $167 million across 9,936 complaints.
Attackers don’t pick targets by size. They pick whoever left a door open. Verizon’s 2026 report also found ransomware in 48% of breaches, up from 44% the year before, and notes that smaller organizations are hit disproportionately.
Why is multi-factor sign-in the first item?
Multi-factor sign-in means a password alone won’t get someone into your account. They also need a code from your phone or an app. Microsoft Research (2023) found it cut account compromise by 99.22% across the accounts it studied.
Start with email, since a hijacked inbox can reset nearly every other password you have. Then add it to your banking, payroll, and Microsoft 365 accounts.
Why does old software put your business at risk?
Once a product stops getting security updates, every new weakness found in it stays open for good. Microsoft ended support for Windows 10 on October 14, 2025. A computer still running it today gets no new security fixes unless you’ve paid for extended updates.
Walk through your office and count. Include the PC at the front desk and the one in the back that runs the label printer. Those are the ones people forget.
How do you know your backups actually work?
You restore something from them. A backup you’ve never tested is a guess. Pick one file and one full computer a few times a year and bring them back from backup, then time how long it took. That number tells you how long you’d really be down. Our backup and recovery guide walks through building the plan.
What should employees know about fake emails?
Three habits catch most of them. Check the actual sender address, not just the display name. Hover over a link before clicking it. And call to confirm any request to change payment details, using a number you already have, not one from the email.
That last habit matters most. Fake invoice and fake vendor emails cost businesses more than $3 billion in 2025, according to the same FBI report. Password tricks are on the rise too. Our post on password spraying explains one of the most common.
Who should have admin access to your systems?
As few people as possible. Admin access lets someone install software and change security settings, so an attacker who steals an admin login gets the keys to everything. Give everyday accounts everyday permissions. And when someone leaves the company, shut off their accounts the same day.
Is your Wi-Fi set up safely?
Your guest network should be completely separate from the one your business computers use. Customers, delivery drivers, and visiting vendors shouldn’t share a network with your file server. Change the router’s default admin password too. Many still have the one printed on the sticker.
What should you do in the first hour of a cyberattack?
Write this down before you need it. Who do you call first? Who can shut off a compromised account? Where are the backups, and who can start a restore? Who calls your cyber insurance carrier, and when? A one-page plan taped inside a drawer beats a perfect plan nobody can find.
Does your setup match your cyber insurance policy?
Many cyber liability insurance applications now ask directly about multi-factor sign-in, backups, and employee training. If your answers on the application don’t match what’s actually in place, a claim can get complicated. Pull out your policy and read the questionnaire against this checklist.
Frequently asked questions
How often should a small business review its cybersecurity?
At least once a year, and any time you add staff, change systems, or renew your cyber insurance. Those moments are when gaps tend to open.
What’s the first thing to do if I don’t know where to start?
Turn on multi-factor sign-in for email. It’s usually free with the email service you already pay for, and it blocks the most common way attackers get in.
Is antivirus software enough to protect a small business?
No. Antivirus is one layer. It doesn’t stop someone from logging in with a stolen password, and it doesn’t help you recover if your files are encrypted. Sign-in protection, updates, and tested backups do that work.
Does Lightwire Solutions help businesses with cybersecurity in Decatur and Hendersonville?
Yes. Lightwire Solutions is a managed IT services provider with offices in Decatur, Alabama and Hendersonville, Tennessee. Data security is part of the managed IT support we provide across North Alabama and Middle Tennessee.
More on keeping your business secure
- Simple Backup and Recovery Plans Every Small Business Needs
- What is Password Spraying?
- Ultimate Guide to Safe Cloud Storage
Closing and CTA
If you counted more than two gaps, start with multi-factor sign-in and backups. We’ll walk your office with you and show you which items to fix next. Book your free on-site IT assessment.