# Small Business Cybersecurity Checklist | DBLinx > A cybersecurity checklist for small businesses: essential safeguards for accounts, passwords, email, files and employee departures. Source page: https://dblinx.net/en/rehberler/kucuk-isletme-dijital-guvenlik-kontrol-listesi --- Security # Small business cybersecurity checklist: 20 essential measures The small business cybersecurity checklist lists the measures that reduce the highest risk fastest with limited budget and staff. The 20 items below are grouped under accounts, email, files, devices, backup and employee awareness. Each item is written to be set up once and reviewed regularly. 6 min readPublished: 24.09.2026Updated: 29.09.2026 ## What safeguards should be in place for accounts and passwords? - Give every employee their own account; do not use accounts shared via a common password. - Passwords should be at least 12 characters long, unguessable and different for every service; use a password manager. - Turn on two-step verification for every service that supports it, starting with email and finance accounts. - Grant administrator permissions only to the people who genuinely need them. - Close all of a departing employee's accounts on the same day and end their open sessions. ## What should be done to secure email? - Configure SPF, DKIM and DMARC records for your company domain. - Always verify payment detail changes and urgent payment requests by phone. - Make it a rule never to open unexpected attachments or any that ask you to run macros. - Use shared addresses (info@, accounting@) through per-person permissions, not by sharing a password. ## How should files and data be protected? - Keep files in separate areas by department or project; avoid a single shared folder where everyone can see everything. - Grant access according to job role: people who can read, upload and delete should be separate groups. - Keep version history for important documents so that accidentally changed or deleted files can be restored. - Document in writing where documents containing personal data are stored and how long they will be retained. ## What are the basic safeguards for devices and the network? - Keep automatic updates turned on for operating systems and applications. - Turn on disk encryption on laptops so that a lost device does not become a data loss. - Set up a separate wireless network for guests; do not share the company network, and change the wireless network password regularly. ## How do you prepare backups and incident response? - Back up critical data regularly and test restoring from a backup at least once a year. - Write on a single page who to call in a security incident, along with the contact details for your bank and IT support. ## How do you build employee awareness? - Give a short reminder every three months, based on real examples. - Provide an easy, blame-free way to report a suspicious email or incident. This list is a starting point; tick off each item as you implement it and review the list every six months. As your business grows, you will need to prepare detailed policies for some items. ## Where should you start with the checklist? You do not have to implement every item at once. Three items have the fastest impact: two-step verification on email and finance accounts, phone verification of payment detail changes, and ending the use of shared passwords. These three directly address a significant share of the most common losses in small businesses. The second phase covers domain records, file access permissions and backups. In the final phase, policies are put in writing and a regular review calendar is set up. At the end of each phase, record in a short note which items were completed, which were postponed and why; this note becomes the starting point for the next review. ## How can the checklist be implemented in 30 days? - **Week 1:** Turn on two-step verification for email and finance accounts; announce in writing the rule of phone verification for payment detail changes. - **Week 2:** Remove shared passwords; give each employee their own account and review administrator permissions. - **Week 3:** Complete your domain's SPF, DKIM and DMARC records; clean up the access lists of file areas. - **Week 4:** Test restoring from a backup, prepare the page of people to call in an incident and hold the first awareness session. ## What are the most common mistakes? - Setting up safeguards once and never reviewing them; accounts of departed employees and outdated permissions build up over time. - Relying on technical measures alone; attacks such as payment fraud target gaps in the process. - Relaxing security rules for administrators; attackers most often impersonate administrators. - Taking backups but never testing a restore; a corrupt or incomplete backup is only discovered when it is needed. - Blaming the employee who reported the incident; this attitude leads to the next incident being covered up. ## Why are these sections covered in this order? Most attacks on small businesses don't start from a technical flaw, but from a compromised account or a persuaded employee. That's why the list opens with accounts and email: a single compromised email account gives an attacker both the organization's correspondence and the password-reset links for every other service tied to that account. Files come second, because once an account is compromised, the extent of the damage is determined by the data that account can reach. In a setup where everyone can see everything, a single account exposes the whole organization; with access split by role, the damage stays confined to one area. Devices, backups and awareness are what make these measures last. An out-of-date device leaves a door open, an untested backup is useless on a bad day, and a team that hasn't been briefed can skip even the best-designed process without realizing it. ## Which items on this checklist does DBLinx cover? The DBLinx family covers the email, file and account items on this list within the product itself. Employees sign in to all products with a single identity; login screens are protected against automated bot traffic by DBLinx Security. When a person is removed from the organization, their access across all products is revoked in a single action. In SmartMail, shared addresses are used without sharing a password, through nine separate permissions per mailbox; your domain's SPF, DKIM and DMARC records are set up through the setup wizard. In SmartFiles, files sit in department-based areas, eight separate permissions are granted per area, every file keeps a version history, and deleted items wait in the recycle bin. Details: [DBLinx Security](https://dblinx.net/en/smart360-security) and [DBLinx ecosystem](https://dblinx.net/en/ekosistem). ## Frequently asked questions Is cybersecurity expensive for a small business? A large part of the checklist costs nothing extra: two-step verification, password rules, payment verification and access management are mostly a matter of changing habits. Where should I start with two-step verification? Start with the highest-risk accounts: email, banking and accounting accounts. How often should I review this checklist? Every six months, and after any significant change, such as moving to a new service, a staff change or a security incident. Do we still need backups if we use a cloud service? Yes. A cloud service keeps the infrastructure running, but to restore a file that an employee has accidentally deleted or overwritten, you need to plan version history, a recycle bin and your organization's own backup arrangements separately. Check your service provider's documentation to find out which data can be restored and for how long. We have no IT staff. Where should I start? Start by applying the items in the accounts and email sections, as they directly address the most common attacks. ## Get started with DBLinx Calculate the price for your needs, or write to our team with your questions; we reply within the same business day. [Request a quote](https://dblinx.net/en/teklif-iste)[Get in touch](https://dblinx.net/en/iletisim) ## Other guides - [SecurityWhat is CEO fraud? A guide to protecting against fake IBAN emailsCEO fraud is an email scam in which an attacker posing as an executive or supplier convinces an employee to make an urgent payment or pay a fake IBAN. The attacker wants the payment redirected to another account. These emails often carry no malicious link or attachment, so they easily pass through standard spam filters.6 min read](https://dblinx.net/en/rehberler/ceo-dolandiriciligi-sahte-iban) - [SecurityHow to spot a fake invoice email: a checklist for accounting teamsA fake invoice email is identified by checking the sender address, attachment, amount and bank details against independent records. These emails appear to come from a genuine supplier and report an unpaid invoice or changed payment details. The goal is to redirect the payment to the attacker's account or get the malicious attachment opened.6 min read](https://dblinx.net/en/rehberler/sahte-fatura-mailleri) - [SecurityWhat are SPF, DKIM and DMARC? An email authentication guide for administratorsSPF, DKIM and DMARC are three DNS records that verify that emails sent on behalf of a domain actually come from that domain's owner. SPF defines the authorized servers, DKIM confirms the email wasn't altered, and DMARC determines what happens to mail that fails the check. Set up together, they make your domain much harder to impersonate.6 min read](https://dblinx.net/en/rehberler/spf-dkim-dmarc-rehberi)