SMALL BUSINESS IT RISK CHECKLIST

Use this as a quick risk review for your business technology.

1. Critical systems
- What business systems are essential to daily operations?
- Are there staff or vendors who are the only ones who understand them?
- Do we have a list of all critical software and tools?

2. Backups and recovery
- Are backups running automatically?
- Are critical files backed up daily or more frequently?
- Have we tested restoring files in the last 12 months?
- Do we know who is responsible for recovery?

3. Passwords and access
- Are passwords unique for each system?
- Do we use multi-factor authentication for email and admin accounts?
- Are old accounts removed when staff leave or change roles?

4. Devices and support
- Are devices still receiving security updates?
- Are laptops and desktops aging, unstable, or repeatedly failing?
- Are staff working on personal devices without clear security rules?

5. Email and communication
- Are staff trained to spot phishing emails?
- Are suspicious requests verified by a trusted contact method?
- Are email accounts protected with MFA?

6. Connectivity and internet
- Do we have a stable internet connection for critical work?
- Is there a backup option during outages?
- Are Wi‑Fi and router issues recurring or affecting productivity?

7. Business continuity
- Do we know what systems we cannot afford to lose for a day?
- Is there a plan for internet outage, ransomware, or device failure?
- Have we documented who does what in an emergency?

8. Cybersecurity basics
- Do we have antivirus and endpoint protection in place?
- Are updates installed regularly across devices?
- Are we monitoring unusual login or security activity?

9. Vendor and support relationships
- Do we know who supports our internet, email, website, and devices?
- Are support responsibilities clear?
- Are renewals or subscriptions tracked?

10. Data protection
- Are sensitive customer or financial records stored securely?
- Are access permissions appropriate for each person?
- Is there a process for protecting information outside the office?

11. Recovery confidence
- If a key system failed today, how long would it take to recover?
- Would the business still operate normally for a day or more?
- Are critical files accessible from another device if needed?

12. Action plan
- Identify the top 3 risks to address first
- Assign ownership for each issue
- Set a date for review and follow-up

If several items are still unchecked, it may be worth a professional technology review before the issues become business disruption.