Cybersecurity Checklist for Growing Businesses

Growing businesses are attractive targets: they hold valuable data and money, but often lack a dedicated security team. The good news is that a handful of well-implemented basics prevent a large share of common attacks. This cybersecurity checklist for growing businesses is organised by priority so you can make progress step by step.

1. Identity and access

Most breaches involve compromised credentials. Start here.

• Enable multi-factor authentication (MFA) on email, cloud services, finance systems and admin accounts — prioritising admins.
• Use a password manager and unique passwords for every service.
• Apply least privilege: people get the access their role requires, and no more.
• Remove access promptly when someone changes role or leaves.
• Separate admin accounts from everyday accounts.

2. Devices and software updates

• Keep operating systems, browsers and applications updated automatically.
• Use reputable endpoint protection on laptops and servers.
• Encrypt laptops and mobile devices, and enable remote wipe.
• Maintain an inventory of devices and software so nothing is forgotten.

Our managed IT services include patching, endpoint management and monitoring for teams without in-house IT capacity.

3. Email and people

• Configure email authentication (SPF, DKIM and DMARC) to reduce spoofing.
• Run regular, practical security awareness training focused on phishing and payment fraud.
• Establish a verification process for payment or bank-detail changes — for example a call-back to a known number.
• Make it easy and blame-free for staff to report suspicious messages.

4. Data protection and backups

• Know where your sensitive data lives and who can access it.
• Follow the 3-2-1 backup principle: multiple copies, on different media, with one off-site or immutable.
• Test restores regularly — a backup you have never restored is a hope, not a plan.
• Encrypt sensitive data at rest and in transit.
• Collect and keep only the personal data you need, in line with applicable data protection laws.

5. Cloud and network

• Review cloud permissions and public sharing settings regularly.
• Enable logging and alerts for sign-ins and configuration changes.
• Restrict administrative interfaces and remote access; avoid exposing services unnecessarily.
• Use separate environments for development, testing and production.

Our cloud migration checklist covers security guardrails for new cloud environments.

6. Secure software and websites

If you build or commission software, security must be part of the development process:

• Follow secure coding practices aligned with widely used guidance such as the OWASP Top 10.
• Validate input, escape output and use parameterised database queries.
• Keep frameworks and dependencies updated and scan them for known vulnerabilities.
• Store secrets in environment configuration or a secrets manager — never in source code.
• Use HTTPS everywhere and sensible security headers, including a Content Security Policy.
• Apply role-based access control and audit logging for administrative actions.

7. Suppliers and third parties

• Understand which suppliers hold your data or have access to your systems.
• Check their security practices proportionately to the risk.
• Remove integrations and accounts you no longer use.

8. Incident readiness

• Write a short incident response plan: who decides, who communicates, who to call.
• Keep contact details for key suppliers, insurers and advisers offline as well as online.
• Know your notification obligations under applicable regulations.
• Run a tabletop exercise so the plan is familiar before you need it.

How to prioritise

1. This month: MFA everywhere, automatic updates, backups with a tested restore.
2. This quarter: least-privilege review, email authentication, awareness training, device encryption.
3. This year: incident response plan and exercise, supplier review, application security testing.

If you would like an independent view of your risks, our cybersecurity consulting team provides prioritised, practical recommendations.

Building a security culture

Tools and policies only work if people understand and support them. A positive security culture makes the safe behaviour the normal behaviour:

• Lead by example: leadership using MFA and following procedures sets the tone.
• Keep training practical: short, regular sessions using realistic examples are more effective than an annual lecture.
• Reward reporting: thank people who report suspicious emails, even when they turn out to be harmless.
• Make secure options easy: provide password managers, approved file-sharing tools and clear guidance.
• Share lessons learned: when incidents or near-misses happen, explain what changed as a result.

Security when building or buying software

Many security issues are introduced through new systems. Whenever you buy or build software, ask:

• How are users authenticated, and is multi-factor authentication supported?
• Can access be limited by role, and are administrative actions logged?
• Where is data stored, how is it encrypted and how are backups handled?
• How are security updates delivered, and how quickly are vulnerabilities fixed?
• Can data be exported if you change supplier?

Asking these questions early is far cheaper than discovering gaps after launch. When we deliver custom software, these controls are designed in from the first sprint.

Choosing where to invest next

Once the basics are in place, use risk to guide further investment. Ask which systems and data would cause the most harm if compromised, which threats are most likely for your sector, and where controls are weakest. A short annual risk review with leadership keeps security aligned with how the business is changing.

Security is never finished, but steady, prioritised progress makes a real difference. Revisit this checklist regularly, record what has been completed and set clear owners and dates for the remaining items so improvements do not stall when other priorities compete for attention.

Key takeaways

• MFA, updates and tested backups address many common attack paths.
• People and processes matter as much as technology — especially for payment fraud.
• Build security into software development rather than adding it at the end.
• Prepare an incident response plan before you need it.

Frequently asked questions

We are a small team — where should we start?

Enable MFA on email and key systems, turn on automatic updates, and set up backups with a tested restore. These steps give a strong foundation quickly.

Do we need a penetration test?

For customer-facing applications or sensitive data, independent security testing is valuable — ideally after the basics are in place, so testers find the deeper issues.

How often should we review security?

Review access and configurations regularly, and revisit your overall posture at least annually or when you introduce major new systems.