Nobody opens a business thinking, "you know what I really want to run? A part-time IT department." And yet, here we are.
Bad news first: nearly half of all cyberattacks go after small businesses, and most of them work for painfully dumb reasons. A reused password. An update somebody clicked "remind me tomorrow" on for nine months straight. A backup that existed mostly as a vibe.
Good news: you don't need a hoodie and three monitors to fix this. You need five minutes and this list.
Why five minutes is actually enough
Hackers aren't in a dark room whispering your company name. That would require them to care about you specifically, and they don't. They run bots that rattle thousands of digital doorknobs at once, looking for the ones left unlocked.
So the goal isn't to be Fort Knox. The goal is to not be the minivan with the doors unlocked and the keys on the seat.
The checklist
Coffee up. Five items, about a minute each. Go.
1. Is multi-factor authentication on for your email?
Multi-factor authentication (MFA) means logging in needs your password and a code from your phone. So when a criminal steals your password, they get... a password. Congratulations to them.
Your email is the crown jewel, because whoever owns it can reset the password on basically everything else you touch. Lose the email, lose the kingdom. Turn MFA on today. Google, Microsoft, all of them offer it free, which is the correct price for not getting robbed.
Do it: Email settings → Security → "2-step verification."
2. Are you using the same password everywhere?
Be honest, nobody's watching. If your email password also unlocks your bank, your QuickBooks, and your fantasy football league, you don't have four accounts. You have one account wearing four hats, and one leak takes every hat off at once. Breaches happen constantly, and criminals take those leaked passwords and try them everywhere else automatically, millions of guesses a minute. It's less "master thief" and more "toddler flipping every light switch in the house," except it works.
Do it: Figure out where else that email password lives. If the answer isn't "nowhere," that's this week's homework. (A password manager makes this painless. We'll get there.)
3. When did your computer last update?
Most successful attacks squeeze through holes that were patched months ago, on machines that hit "not now" every single time. Updates are annoying. Ransomware is annoying, expensive, and occasionally a business-ending event, so pick your annoying carefully.
Do it: Windows: Settings → Windows Update. Mac: System Settings → General → Software Update. Install whatever's waiting, then switch on automatic updates so this becomes Future You's non-problem.
4. If your laptop died right now, would your business survive?
Not "would it be a bad day." Would you still have your customers, your invoices, your files? If it all lives on one laptop, then one tipped-over latte or one bad click is the entire story.
Do it: Say out loud where your second copy lives. Drew a blank? Set up automatic cloud backup this week. Google Drive, OneDrive, and Dropbox all do it; Backblaze runs about $9 a month for unlimited, which is roughly two coffees to never lose everything you've built.
5. Can anyone who left still get in?
The intern from two summers ago. The contractor you Venmo'd exactly once. If their logins still work, part of your security is being handled by people who don't work for you and may not particularly like you.
Do it: Picture the last person who walked out the door. Can they still open email, the point of sale, the files? "Not sure" counts as "yes." Go shut it off.
Score yourself
- 5 out of 5: You're ahead of most businesses on your street. A little smugness is permitted.
- 3 to 4: So close. Close the gaps this week, each one's under an hour.
- 0 to 2: Deep breath. Do item #1 today, right now, before the next shiny thing steals your attention. It's the single biggest win on the list.
The bottom line
You don't have to outrun the bear. You have to outrun the guy next to you who's been using "Summer2019!" for everything since, well, 2019. Five checks, five minutes, and you're already ahead of most of the pack.
Want it as a one-pager? Grab the free Small Business Security Quick-Check, a printable you can run every quarter and pin somewhere your team will actually look.