Run it with less chaos · Every business
The Ten-Minute Security Checklist: Passwords, Two-Factor and Backups
Federal guidance for small businesses comes down to a short list of habits, and the one with the clearest evidence behind it, turning on two-factor sign-in for the accounts that hold money and customer data, takes a few minutes per account.
Start with three things: turn on two-factor sign-in (also called multifactor authentication) for email, banking, payments and your booking or job system; give every account a long, unique password stored in a password manager; and back up your important files somewhere separate from the computer they live on. CISA, the federal cybersecurity agency, lists four steps for small businesses (phishing training, strong passwords, multifactor authentication and software updates), and the FTC's small business guidance adds backups.
The checklist to copy
Work down the list in one sitting, then repeat the check every quarter.
| # | Check | Time | Done when |
|---|---|---|---|
| 1 | Turn on two-factor sign-in for business email | 2 min | A code or app prompt is required at sign-in |
| 2 | Turn on two-factor for bank, card processor and payroll | 3 min | Each account asks for a second step |
| 3 | Turn on two-factor for booking, job or practice software | 2 min | Every staff login uses it |
| 4 | Move passwords into a password manager | Ongoing | No password is reused across accounts |
| 5 | Replace short passwords with ones of at least 12 characters | Ongoing | Email and banking first |
| 6 | Turn on automatic updates on phones, computers and browsers | 2 min | Updates install without anyone remembering |
| 7 | Back up files to an external drive or the cloud | 1 min to check | You can open last week's copy of a key file |
| 8 | Give each staff member their own login | Varies | No shared passwords at the front desk |
| 9 | Remove logins for anyone who has left | 1 min each | The list of users matches the team |
| 10 | Agree a rule for payment changes | 1 min | Any new bank details are confirmed by phone, using a number you already have |
A few details that matter
- Which second step to use. CISA lists a text code, an authenticator app or a biometric such as a fingerprint as options; the study cited below found authenticator apps more effective than text codes, and any of them far better than a password alone.
- What counts as a strong password. The FTC describes a strong password as at least 12 characters mixing numbers, symbols and capital and lowercase letters, never reused and never shared by phone, text or email.
- Where backups go. The FTC advises backing up important files offline, on an external hard drive or in the cloud, and storing paper files securely, so open one backed-up file each quarter to confirm the copy works.
- Wi-Fi. The FTC advises turning on WPA2 or WPA3 encryption, changing the router's default name and password and turning off remote management.
Why it works
Stolen and guessed passwords are among the most common ways into a business's accounts, and a second sign-in step blocks nearly all of those attempts. In a study by Microsoft researchers of accounts showing suspicious activity, multifactor authentication reduced the risk of compromise by 99.22% across the whole population and by 98.56% for accounts whose passwords had already been exposed, with app-based methods outperforming text codes. For a sense of scale, Verizon's 2025 Data Breach Investigations Report found credential abuse among the leading ways attackers got in, at 22% of breaches.
If something does go wrong, report a fraudulent payment to your bank and at ic3.gov the same day; the FBI's Recovery Asset Team reported freezing $679 million of $1.16 billion in attempted theft in 2025, a 58% success rate.
General information, not legal advice; talk to a licensed professional about your situation.
Sources
- Cybersecurity and Infrastructure Security Agency. Secure Your Business. Secure Our World program.
- Federal Trade Commission. Cybersecurity Basics. Cybersecurity for Small Business.
- Meyer, L. A., Romero, S., Bertoli, G., Burt, T., Weinert, A. and Lavista Ferres, J. How Effective Is Multifactor Authentication at Deterring Cyberattacks? arXiv, 2023.
- Verizon. 2025 Data Breach Investigations Report. 2025. 12,195 confirmed breaches.
- Federal Bureau of Investigation, Internet Crime Complaint Center. 2025 Internet Crime Report. 2026.
Related reading: Customer Data Privacy Basics for Small Service Businesses · Writing Your First Standard Operating Procedures · What Goes in a New-Hire Checklist for a Small Business · What Scams and Cyberattacks Cost Small Businesses
Work with osNOVA on security habits your team will keep
Email hello@osnovaops.com about your business
Not ready to talk? osNOVA runs free live events for owners.