A 10-person company does not need an enterprise security programme. It needs about twelve habits done consistently: multi-factor authentication on every account that matters, automatic patching, tested backups, a locked-down email setup, managed endpoint protection, a separated Wi-Fi network, a clean offboarding routine, a one-page incident plan, tight vendor access, and an insurance policy that matches reality. This checklist walks through each one in the order we would do it for a client, with the exact settings to check and the mistakes we see most often.
It is written for owners and office managers in the US, UK, Canada and Australia who do not have a full-time IT person. The guidance follows the baseline advice published by CISA (US), the National Cyber Security Centre (UK), the Canadian Centre for Cyber Security and the Australian Cyber Security Centre. Those agencies disagree on very little at this level. If you want a deeper, auditor-style review once the basics are in place, our IT security audit checklist covers formal assessment categories and costs.
Who wrote this guide
This guide was written by IT Cares, an IT support company founded in 2014 that helps small businesses with security setup, backups and incident response. It reflects the problems we are called in to fix, not a vendor sales sheet. We name official sources throughout so you can verify any recommendation yourself.
Why ten people is the awkward size
At one to three people, the owner can personally watch everything. At fifty, you can justify a dedicated IT hire. At ten, you have enough staff that nobody has a complete picture: someone shares a login in a chat thread, a former contractor still has access to the shared drive, two laptops have not been updated in months, and nobody is sure where the backups actually go. Attackers do not need to be sophisticated to exploit that. Most small business incidents start with a stolen password, a convincing email, or an unpatched device.
The good news is that the controls that stop the common attacks are mostly cheap and mostly configuration, not hardware. The NCSC Small Business Guide and the CISA Cyber Essentials both make the same point: a short list of basics, done well, removes the majority of everyday risk. We have deliberately left out statistics we could not trace to a primary source, because a checklist should stand on what to do, not on scary numbers.
How to use this checklist
- Assign one owner. Pick one person (even if it is you) who is accountable for the list. Shared responsibility becomes nobody's job.
- Work top to bottom. The sections are ordered by risk reduction per hour spent. Accounts and MFA come first for a reason.
- Write down what you find. A simple spreadsheet with columns for item, status, owner and date is enough.
- Re-check quarterly. Put a 60-minute review in the calendar every three months.
Step 1: Accounts, passwords and multi-factor authentication
Stolen or guessed credentials remain the front door for most small business compromises, which is why every agency listed above puts account security first. This is the highest-value hour you will spend.
Accounts checklist
- List every business account that holds money, customer data or email: email platform, accounting, banking portals, payroll, CRM, cloud storage, domain registrar, website hosting, social media.
- Turn on multi-factor authentication (MFA) for all of them, starting with email, banking, the domain registrar and the admin accounts of every cloud service.
- Prefer an authenticator app or a hardware security key over text-message codes. CISA recommends phishing-resistant MFA (such as FIDO2 security keys or passkeys) where available, especially for administrators and finance staff.
- Deploy a business password manager and require its use. Staff should never store passwords in a browser on a shared machine, a spreadsheet, or a chat thread. See our business password manager guide.
- Use long, unique passphrases. Current NIST guidance (SP 800-63B) favours length over forced complexity and advises against mandatory periodic password changes unless there is evidence of compromise. The NCSC gives the same advice.
- Create separate admin accounts. Nobody should read email or browse the web while logged in as a global administrator.
- Keep two break-glass admin accounts with strong unique passwords stored offline, so a lost phone does not lock you out of your own tenant.
If you are unsure how to roll MFA out without annoying staff, read our MFA guide for business owners. The practical order is: owner and finance first, then everyone with email, then the long tail of other tools.
A common mistake: MFA on, but exceptions everywhere
We often find MFA "enabled" on paper while legacy protocols, old shared mailboxes or an exempted executive account bypass it. After switching MFA on, sign in as a normal user from a new device and confirm you are prompted. Then check the sign-in logs for any successful logins that skipped MFA.
Step 2: Patching and updates
Attackers routinely exploit known vulnerabilities for which a fix already exists. The CISA Known Exploited Vulnerabilities catalogue exists precisely because the same old flaws keep being used against organisations that did not update. For a 10-person company, patching is about making updates automatic and then verifying that they actually happened.
Patching checklist
- Turn on automatic updates for Windows, macOS, iOS and Android on every company device. Windows 10 reached end of support in October 2025, so any machine still on it needs a plan: upgrade, replace, or enrol in the vendor's extended security update programme as a stopgap.
- Update browsers and the apps staff use daily (Office suite, PDF reader, video conferencing, remote-access tools). Browsers are a favourite target.
- Patch the router, firewall, NAS and printers. Network hardware is the most commonly forgotten item, and it sits outside most staff laptops' update cycle.
- Set a monthly "patch check" where one person confirms every device reports as up to date. Do not rely on trust.
- Remove software nobody uses. Every installed program is another thing to patch.
- Replace anything the manufacturer no longer supports. An unsupported device cannot be made safe.
If you want to understand why monthly Microsoft releases matter, our Patch Tuesday guide for small businesses explains what is in a typical release and how quickly to apply it.
Step 3: Backups you have actually tested
Backups are the control that turns a catastrophe into an inconvenience. They only work if they are recent, separate from the systems they protect, and proven to restore. CISA's ransomware guidance and the NCSC both stress offline or immutable copies, because modern ransomware deliberately hunts for and encrypts connected backups.
Backup checklist
- Follow the widely used 3-2-1 rule: three copies of important data, on two different types of storage, with one copy offsite or offline.
- Include cloud data. Microsoft 365 and Google Workspace keep your data available, but they are not a substitute for an independent backup if an account is compromised or content is deleted maliciously.
- Make at least one copy immutable or disconnected, so ransomware running with an employee's permissions cannot reach it.
- Back up the things people forget: accounting files, the email archive, the shared drive, the website, and configuration of the router and firewall.
- Test a restore every quarter. Pick a random file and a random folder, restore them, and note how long it took.
- Write down your recovery target: how many hours of downtime and how much lost work you can tolerate. That number decides how you back up.
For costs and setup options, see our guides on automated backups for small business and cloud backup for business.
Step 4: Email and phishing defences
Email is where most attacks begin, from credential-stealing links to invoice fraud. Technical filters catch a lot, but at ten people the combination of settings and short, regular staff training does the most good.
Email checklist
- Publish SPF, DKIM and DMARC records for your domain so criminals cannot easily impersonate you. Start DMARC in monitoring mode, then move to quarantine or reject once legitimate mail is aligned.
- Enable your email platform's built-in anti-phishing, attachment scanning and link protection features. Many are included in business plans but switched off by default.
- Block automatic external forwarding rules. Attackers who break into a mailbox often create a hidden rule that silently copies every message to themselves.
- Add a visible banner on messages that come from outside the company.
- Create a payment verification rule: any change to bank details, and any urgent transfer request, must be confirmed by phone using a number you already hold, never one from the email.
- Give staff an obvious way to report suspicious messages, and thank them when they do, even for false alarms.
Payment redirection is one of the costliest small business scams. Our guides on invoice and vendor fraud and spear phishing show what these messages look like in practice, and AI-written phishing explains why bad grammar is no longer a reliable warning sign.
Step 5: Endpoint protection on every laptop and phone
Every computer that touches company data is an endpoint, including the owner's home laptop and any phone that reads company email. The goal is simple: each one is encrypted, protected, locked and managed.
Endpoint checklist
- Run reputable, centrally managed endpoint protection on every computer, so one person can see the status of all ten machines. Built-in Microsoft Defender, correctly configured and monitored, is a legitimate option for many small teams. Whatever you choose, make sure someone actually reads the alerts.
- Turn on full-disk encryption (BitLocker on Windows, FileVault on macOS). A lost laptop then becomes a hardware loss instead of a data breach.
- Require a screen lock after a few minutes and a PIN or password on every phone and tablet that accesses work email.
- Remove local administrator rights from daily-use accounts. Most malware needs elevated rights to do real damage.
- Keep a simple inventory: device, owner, operating system, purchase date, encryption status. You cannot protect what you have not listed.
- Decide on personal devices. Either enrol them in a lightweight management profile or restrict them to web access with MFA, with no local copies of company files.
Not sure whether antivirus alone is enough? Our EDR versus antivirus comparison explains when the extra detection and response capability is worth paying for.
Step 6: Wi-Fi and the office network
The office router is often a consumer device installed years ago and never touched again. A few settings make a big difference.
Network checklist
- Change the default administrator password on the router, and disable remote administration unless you truly need it.
- Use WPA3 where supported, or WPA2 with a long passphrase. Never use open or WEP networks.
- Create a separate guest network for visitors, and keep smart TVs, cameras, printers and other internet-connected gadgets off the main staff network.
- Keep router firmware current, and replace routers the manufacturer has stopped updating.
- Close unnecessary open ports and avoid forwarding remote-desktop access directly to the internet. Use a VPN or a managed remote-access tool that enforces MFA.
- Give remote and hybrid staff written guidance for home Wi-Fi: updated router, strong passphrase, no shared accounts.
Our secure business Wi-Fi guide covers the router settings step by step, and public Wi-Fi safety separates real risks from myths for staff who travel.
Step 7: Onboarding and offboarding
People are the most common source of lingering access. When someone leaves, their accounts, devices, shared passwords and file access should disappear on the same day. In a ten-person firm this is easy to forget, because there is no HR department running a formal process.
Offboarding steps to complete on the last day
- Disable (do not just delete) the user's email and single sign-on account, and revoke active sessions and app passwords.
- Remove them from shared mailboxes, groups, shared drives, the password manager, and any third-party tool they administered.
- Rotate any shared credentials they knew, such as the Wi-Fi passphrase, social media logins or supplier portals.
- Collect laptops, phones, security keys and building access cards, and wipe devices before reissuing them.
- Transfer ownership of documents, calendars and customer relationships to a named colleague.
- Set an automatic mailbox forward or out-of-office reply to a colleague for a defined period, then close it.
For new hires, reverse the process: give each person a named account with the minimum access their role needs, enrol them in MFA on day one, and have them read a one-page acceptable use policy. Applying least privilege from the start is far easier than removing access later.
Step 8: A one-page incident response plan
The worst time to decide who does what is during an attack. CISA, the NCSC and the Canadian Centre for Cyber Security all recommend a short written plan that staff can follow under stress. For ten people, one page is enough, as long as it exists, is printed, and is not stored only on the computers that might be locked.
What the one-page plan contains
- Who decides. Name the incident lead and a deputy, with mobile numbers.
- First moves. Disconnect the affected device from the network (unplug the cable or turn off Wi-Fi), do not power it off unless told to, and do not try to clean it up yourself.
- Who to call. Your IT provider, your cyber insurer's claims line, your bank if money is involved, and a lawyer if personal data may be exposed.
- Evidence. Write down times, screenshots of ransom notes or suspicious emails, and what was clicked or opened.
- Password resets. Which accounts to reset first, and that resets happen from a clean device.
- Communication. A short holding statement for customers, and who is allowed to speak to them.
- Legal duties. A note of the notification rules that apply to you (see the table below).
Run a 30-minute tabletop exercise once a year: read out a scenario, such as "the accountant's laptop shows a ransom note on Friday at 4 p.m.", and see whether everyone knows their role. If the situation is already happening, read our guide on what to do in the first 24 hours after a ransomware attack.
Breach notification rules differ by country
This table is a high-level orientation, not legal advice. Thresholds and deadlines vary by sector and region, so confirm with a qualified adviser before relying on it.
| Region | Regime | What to know |
|---|---|---|
| United States | State breach-notification laws, plus sector rules | All 50 states have their own laws with different triggers and deadlines, so the rule that applies depends on where affected individuals live. |
| United Kingdom | UK GDPR and Data Protection Act 2018 | Reportable personal data breaches must be notified to the ICO within 72 hours of becoming aware, where feasible. |
| Canada | PIPEDA, plus provincial laws | Report breaches that create a real risk of significant harm and keep a record of all breaches. Quebec's Law 25 adds its own incident register and notification duties. |
| Australia | Notifiable Data Breaches scheme (Privacy Act) | Applies to many organisations covered by the Privacy Act. Eligible breaches likely to cause serious harm must be notified, and suspected breaches must be assessed promptly (within 30 days). |
If you operate in Quebec or hold Quebec residents' data, our guide to Law 25 deadlines and the privacy incident register explain the specific obligations.
Step 9: Vendor and third-party access
Your security is only as strong as the weakest supplier with access to your systems. Accountants, bookkeepers, marketing agencies, IT contractors and software vendors often hold real credentials, and they are frequently targeted precisely because they connect to many small clients.
Vendor checklist
- List every vendor with access to your data or systems, what they can reach, and who at your company sponsors the relationship.
- Give each vendor their own named account with MFA. Never share an employee login with an outside party.
- Grant the minimum access needed and set an end date for project-based work.
- Ask suppliers who process personal data how they secure it, where it is stored, and how they will notify you of an incident. A written data processing clause in the contract is worth having.
- Review the list twice a year and remove anyone who no longer needs access.
- Check how your remote IT support provider connects, and confirm every session is logged and requires your approval.
Step 10: Cyber insurance that matches reality
Insurance does not replace controls, but it pays for the response when controls fail. Insurers increasingly ask applicants to prove basic hygiene, which means the steps above also improve your eligibility and may reduce your premium. Questions about MFA, backups, endpoint protection and incident planning are common on applications, so answer them truthfully. An inaccurate application can jeopardise a claim.
- Check what is actually covered: forensic investigation, legal advice, notification costs, business interruption, ransomware payments policy, funds-transfer fraud, and regulator fines where insurable.
- Confirm any sub-limits, waiting periods and exclusions, such as unpatched systems or missing MFA.
- Keep the claims hotline in your incident plan.
For more, see our compliance checklist before buying cyber insurance and how security controls can reduce your premium.
Staff awareness and a lightweight policy
Technology covers most of the list, but people make the daily decisions. A short, plain-language policy beats a long one nobody reads. Cover acceptable use of company devices, handling of customer data, how to report a suspected incident, and what to do before connecting any new app to company accounts. Pair it with 15 minutes of training at onboarding and a short refresher every quarter using real examples from your own inbox. The tone matters: staff who fear blame hide mistakes, and hidden mistakes grow.
Your 30-60-90 day plan
If the full list feels heavy, sequence it. This plan is realistic for a ten-person company working a few hours a week.
| Timeframe | Focus | Done when |
|---|---|---|
| Days 1 to 30 | MFA on email, banking and admin accounts; password manager rolled out; automatic updates on; one tested backup restore | Every high-value account is protected and you have proof a backup works |
| Days 31 to 60 | Email authentication records and filtering; endpoint protection and disk encryption on all devices; router hardening and guest Wi-Fi | Device inventory is complete and every device reports as healthy |
| Days 61 to 90 | Offboarding checklist; one-page incident plan and tabletop; vendor access review; insurance review | Plan is printed, tested once, and calendar reminders are set for quarterly reviews |
When to bring in outside help
Many of these steps are well within reach of a careful owner or office manager. Bring in a professional when you need to verify that settings are actually applied, when you handle regulated data (health, legal, financial), when you are preparing for an insurance application or a customer security questionnaire, or after a suspected incident. A single focused session is often enough to turn this list into a configured, documented baseline.
IT Cares offers a 60-minute Expert Consultation at $119.99 (plus applicable taxes), delivered remotely by a senior technician. It is a practical way to walk through this checklist against your actual setup, prioritise the gaps and leave with a clear to-do list. You can book a session online or call 1 (888) 711-9428. If you want a broader formal review, see our security audit service and cybersecurity services.
Official resources worth bookmarking
- CISA (US): Cyber Essentials and the Known Exploited Vulnerabilities catalogue, at cisa.gov.
- NIST (US): Cybersecurity Framework 2.0 and its small business quick-start guide (SP 1300), at nist.gov.
- NCSC (UK): Small Business Guide and the Cyber Essentials scheme, at ncsc.gov.uk.
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations, at cyber.gc.ca.
- ACSC (Australia): Small Business Cyber Security Guide and the Essential Eight, at cyber.gov.au.