A straightforward account-security checklist for a small business

A small business does not need a complicated security program to improve its starting position. It does need a plan for the accounts that can reset other passwords or reach important money, customer, and business records.

Secure the accounts that can unlock others

Begin with your primary email, password manager, domain registrar, banking or payment accounts, cloud storage, and website administration. If someone can reset another account through an inbox, that inbox deserves extra protection.

• Use unique passwords. A reputable password manager can help create and store them.
• Turn on multi-factor authentication where available, especially for email and administrative accounts.
• Save recovery codes somewhere separate and protected; do not leave them in the same inbox they recover.
• Remove old users and devices when access is no longer needed.

Slow down suspicious requests

Unexpected messages that create urgency—an invoice change, password reset, file share, or request for a gift card—deserve a second check. Use a known phone number or a separate conversation to confirm payment-detail changes. Do not rely on the display name or a familiar logo as proof of who sent the message.

Keep recovery and backups usable

Update devices and software that still receive security fixes. Back up important business files and periodically confirm you can restore a copy. A backup that has never been tested may not help when a device fails or an account is locked.

Write a short response plan: who to contact, how to secure the email and domain accounts, where recovery codes are stored, and how clients will be informed if their work is affected. For a suspected compromise, contact the relevant provider using its official support channel.

Treat this as a starting checklist

Security needs depend on your work, your region, and the data you handle. If you process sensitive or regulated information, get advice from a qualified security or compliance professional instead of relying on a general checklist.

The short version

Protect the email and administrative accounts first, make logins unique, add multi-factor authentication, and test recovery before you need it.

Editorial note: This guide is general information. Check current provider documentation and local requirements before acting on sensitive matters.