Start with the basics.

1. Turn on multi-factor authentication (MFA)Start with email, banking, payroll, and administrator accounts.
2. Use a password managerUnique, long passwords for every account; no shared spreadsheets of passwords.
3. Keep devices and software updatedTurn on automatic updates for operating systems, browsers, and apps.
4. Know what you haveList your devices, cloud services, and who has access to each.
5. Back up important dataKeep at least one copy separate from your main systems, and test a restore.
6. Remove access promptlyDisable accounts the day someone leaves or changes roles.
7. Limit administrator rightsUse separate admin accounts only for tasks that need them.
8. Protect devicesScreen locks, device encryption, and built-in security software on every computer and phone.
9. Secure your Wi-FiStrong password, current router firmware, and a separate guest network.
10. Prepare for phishingTeach staff to verify payment or password requests through a second channel.
11. Write down who to callKeep a short list of contacts and first steps for a security incident.
12. Review vendorsKnow which outside providers hold your data and how they protect it.

Tip: use your browser’s print command to print this checklist or save it as a PDF.