When the business is busy, IT questions tend to collect around whoever seems most likely to know the answer. That might be the owner, the office manager, or the person who once fixed the printer. A useful cybersecurity checklist should make those responsibilities clearer, not give that person another job.
Start by asking what would stop your team from working and what you already know about those risks. Being a smaller company does not make you irrelevant to an attacker. It does mean your plan needs to fit your people, budget, and systems. RIKR works from best practices without assuming every business needs an identical setup.
First, establish what you actually have
List the accounts, devices, applications, and outside providers that support important work. Include the tools bought by individual departments and the people with administrator access. An inventory is useful when it answers who is responsible, whether the system is supported, and where important information is stored.
Then check the basics on the systems that matter most. CISA highlights strong passwords, MFA, recognizing and reporting phishing, and software updates as core habits. For a company, those habits need administration and follow-through. Ask how you know a control is working, not just whether somebody remembers turning it on.
Source: CISA cybersecurity best practices
Work through these questions with your team
- Accounts: are important sign-ins protected by appropriate MFA, and are former employees removed?
- Devices: do supported computers receive updates and antivirus protection, and are failures investigated?
- Email: can people report suspicious messages easily, including after they have clicked?
- Backup: which data and systems are protected, how long are copies retained, and when was a restore tested?
- Network: who manages the firewall, wireless equipment, subscriptions, and support-life dates?
- Response: who receives an urgent report, who can approve action, and where are the backup contact details?
Choose a few improvements you can finish
A list of thirty gaps can leave everyone waiting for a quieter month. Pick priorities based on business impact and exposure. Give each action a responsible person, an intended outcome, and a date for checking progress. If a control cannot be implemented yet, record the reason and the temporary arrangement.
For example, a growing team might begin by reviewing administrator accounts, enforcing stronger sign-ins, and checking whether every new device enters the management process. That is a planning example, not a universal first three steps. A business with failing backups or an exposed unsupported firewall may have a different priority.
Keep usability in the conversation
Security that prevents people from doing their jobs encourages workarounds. Ask what employees find awkward and why. You may need a different approved workflow, clearer instructions, or a small configuration change. Listening does not mean dropping the baseline. It helps you make the baseline workable.
You can search for instructions for many individual IT tasks. The harder part is deciding which instructions apply, understanding their side effects, and keeping the result maintained. If those decisions are taking time away from your role, it is reasonable to bring in an IT team.
Review the checklist when the business changes
A new office, application, hire, or supplier can change the picture. Build a short review into those moments instead of treating cybersecurity as an annual paperwork exercise. NIST CSF 2.0 can provide the broader structure for that conversation, from governance through recovery.
Related: a practical guide to NIST CSF 2.0
Explore RIKR managed IT support
Written by Joshua Price
Back to the blog