NYC Small Business Cyber Checklist

10 checks. Tick what's done; anything unticked is a conversation worth having.

Print / save as PDF

1. Turn on multi-factor authentication (MFA) everywhere

   Email, Microsoft 365, VPN, banking, payroll, and admin accounts. Prefer an authenticator app over text messages.

2. Lock down remote access

   Patch the VPN and firewall, require MFA on it, and remove old or shared VPN accounts. Exposed remote access is a common ransomware entry point.

3. Keep an offline or immutable backup

   At least one copy attackers cannot delete or encrypt (offline, or immutable storage), separate from your normal admin accounts.

4. Test a restore

   Pick a file, a mailbox, and one server or system and actually restore them. Write down how long it took.

5. Patch operating systems and apps

   Turn on automatic updates for Windows/macOS, browsers, and common apps. Replace devices that no longer get security updates.

6. Review admin accounts

   Separate everyday logins from admin logins. Remove admin rights people do not need and disable accounts of former staff.

7. Protect email

   Turn on your provider's spam/phishing protection and set up SPF, DKIM, and DMARC for your domain.

8. Use endpoint protection on every device

   Modern antivirus/EDR on every laptop and server, centrally monitored so alerts are actually seen.

9. Train the team, briefly and often

   Short phishing-awareness refreshers. Set a rule: payment or bank-detail changes are confirmed by phone, never by email alone.

10. Write a one-page incident plan

    Who to call first, how to isolate a device, where backups live, and contact numbers for your IT provider, insurer, and bank.