Every week, some SME somewhere suffers a cyberattack. Ransomware that encrypts all files, phishing that compromises bank accounts, customer data breaches that carry regulatory fines. What is worst is that the majority of these incidents were entirely preventable with basic measures that do not require a dedicated IT department or a huge budget.
This article is a 15-point checklist, with plain-language explanations, so that any SME manager can evaluate their situation and act. You do not need to be an IT professional to understand it or to implement it.
Why cybersecurity is a business problem, not just an IT one
Before getting into the checklist, it is worth understanding the scale of the problem. According to ENISA (the European Union Agency for Cybersecurity), SMEs are the primary target in more than 70% of cyberattacks. The average cost of an incident for a company with fewer than 50 employees exceeds €35,000, including downtime, data recovery, legal fees and reputational damage.
Attackers do not go after large corporations first. They go after companies with fewer defences — those without a security team, those that use weak passwords and have never made a real backup. That, very often, is SMEs.
The 15-point checklist
Go through each point and honestly note whether your company has it covered. At the end you will have a clear map of your priorities.
1. Strong passwords and a password manager
1Strong passwords + password manager
What it is: A strong password has at least 16 characters, mixes letters, numbers and symbols, and is not reused across other services. A password manager (Bitwarden, 1Password, KeePass) generates and stores them securely.
Why it matters: 81% of security breaches involve weak or reused passwords. If someone gets the password to one service and the same one works for the corporate email, access is immediate.
How to implement it: Adopt a password manager for the whole company. Bitwarden has a free plan for personal use and team plans from €3/user/month. Establish a policy requiring unique passwords for each service.
2. Multi-factor authentication (MFA) on critical accounts
2Multi-factor authentication (MFA)
What it is: MFA requires a second verification factor when logging in: a code on your phone, an authenticator app (Google Authenticator, Microsoft Authenticator) or a physical key (YubiKey).
Why it matters: With MFA active, stealing the password is not enough to get in. Microsoft estimates that MFA blocks 99.9% of automated account attacks.
How to implement it: Activate MFA immediately on: corporate email, online banking, ERP/CRM, remote access (VPN, remote desktop), hosting and domain panel. Most services offer it free in their security settings.
3. Automatic patches and updates
3Automatic patches and updates for OS and software
What it is: Keeping Windows, macOS, Linux and all installed applications updated to the latest available version, preferably automatically.
Why it matters: Most ransomware and malware exploits known vulnerabilities that have been unpatched for months. WannaCry in 2017 infected 200,000 organisations in 150 countries; all were running unpatched Windows.
How to implement it: On Windows, configure Windows Update in automatic mode. For third-party software, use tools like Patch My PC (free) or Chocolatey. If managing several devices, an RMM (Remote Monitoring & Management) solution centralises patches.
4. Verified backups with restore testing
4Verified backup with periodic restore testing
What it is: A real, automatic backup that includes all critical business data and whose restoration is tested at least once per quarter. The 3-2-1 rule: 3 copies, on 2 different media, 1 offsite (in the cloud).
Why it matters: A backup that has never been tested is not a backup, it is a hope. In the event of ransomware, the backup is the only way to recover data without paying the ransom.
How to implement it: Backblaze B2 + Veeam, Azure Backup, or simply a NAS with cloud replication. What matters is that it is automatic, outside the main network (ransomware can also encrypt mounted network drives) and tested regularly.
5. Firewall and guest WiFi network segmentation
5Active firewall and separate guest WiFi network
What it is: The firewall controls what traffic enters and leaves the network. Segmentation creates separate networks: one for work devices and another for employee mobiles, visitors and IoT devices.
Why it matters: If a device is infected on the guest network, it cannot spread to work devices. Modern office routers (UniFi, Mikrotik, Fortinet) allow this segmentation without major complications.
How to implement it: Configure a VLAN or separate WiFi network for guests and personal devices. Ensure the office router has updated firmware and that the admin panel is not accessible from the internet.
Want us to audit your company's IT security?
We review your infrastructure, identify vulnerabilities and deliver a concrete, prioritised action plan.
6. Antivirus and EDR on all devices
6Antivirus / EDR on all endpoints
What it is: Classic antivirus detects known threats by signature. An EDR (Endpoint Detection & Response) goes further: it monitors behaviour in real time and can stop new threats (zero-day).
Why it matters: Modern attacks evade traditional antivirus. Solutions like Microsoft Defender for Business (included in Microsoft 365 Business Premium), CrowdStrike Falcon Go or SentinelOne offer enterprise-grade protection at SME-friendly prices.
How to implement it: For companies with Microsoft 365 Business Premium, Defender for Business is included. For mixed environments, evaluate Malwarebytes Teams or Bitdefender GravityZone.
7. Least privilege access policy
7Access controls: principle of least privilege
What it is: Each employee only has access to the data and systems they need to do their job. The administrator does not access the production server. The sales rep cannot view HR contracts.
Why it matters: If a compromised account has access to everything, the attacker has access to everything. Limiting privileges contains the damage in the event of an incident.
How to implement it: Review permissions in Google Workspace, Microsoft 365, the ERP and servers. Create user groups by role. Delete ex-employee accounts immediately upon departure. Activate alerts for access from unusual locations.
8. Anti-phishing training for the team
8Phishing training and simulations
What it is: Phishing consists of fraudulent emails or messages pretending to be from a bank, supplier or colleague, aiming to get the employee to click a malicious link or reveal their credentials.
Why it matters: 90% of cyberattacks start with a phishing email. Technology can filter many, but no filter is perfect. The last line of defence is human judgement.
How to implement it: Tools like KnowBe4, Proofpoint Security Awareness or Phished allow sending phishing simulations and measuring who falls for them. An annual training session plus periodic simulations dramatically reduces the click rate on malicious links.
9. Documented incident response plan
9Incident response plan (even a basic one)
What it is: A document describing what to do if a security incident occurs: who to call, how to isolate infected devices, how to notify the data protection authority if there is a personal data breach, how to restore service.
Why it matters: In the panic of an active attack, nobody remembers what to do. GDPR requires notifying data breaches to the supervisory authority within 72 hours; without a clear process it is nearly impossible to meet that deadline.
How to implement it: It does not have to be a 50-page document. Start with a one-page summary: emergency contacts, immediate steps (disconnect the device from the network, preserve evidence, notify the IT manager), and criteria for when to notify the supervisory authority.
10. VPN for remote workers
10Corporate VPN for remote access
What it is: A VPN (Virtual Private Network) creates an encrypted tunnel between the employee's device and the company network, regardless of the connection they use (hotel WiFi, café, home).
Why it matters: Remote working has multiplied the attack surface. An employee accessing the ERP from a public WiFi network without a VPN is transmitting potentially interceptable traffic.
How to implement it: WireGuard (open source, free) on a small VPS, or managed solutions like Tailscale (free up to 3 users, very easy to configure), Cloudflare Zero Trust or Cisco AnyConnect for larger companies.
11. Disk encryption on laptops and mobile devices
11Disk encryption on laptops and devices
What it is: Disk encryption protects data stored on a device. If a laptop is lost or stolen, the data is unreadable without the correct key.
Why it matters: The loss or theft of a laptop with unencrypted customer data is a reportable data breach under GDPR. With active encryption, the risk disappears.
How to implement it: BitLocker on Windows (included in Windows 10/11 Pro), FileVault on macOS. Both are activated in system settings in less than 5 minutes. For mobiles, modern iOS and Android devices are encrypted by default.
12. Software inventory and removal of abandoned applications
12Active software inventory and removal of abandoned software
What it is: A register of all applications installed on company devices, with particular attention to software that is no longer used, old unsupported versions and web services nobody maintains.
Why it matters: Abandoned software does not receive security patches. A three-year-old WordPress installation on the server without updates can be the entry point to the entire infrastructure.
How to implement it: Tools like PDQ Inventory (Windows) or simply an annually reviewed spreadsheet. Uninstall everything not actively used. Close accounts in SaaS tools nobody uses.
13. GDPR-compliant data handling
13Basic GDPR compliance in data handling
What it is: The General Data Protection Regulation requires handling personal data of customers, employees and suppliers with appropriate technical and organisational measures, informing people of processing activities, and correctly managing rights requests (access, deletion, etc.).
Why it matters: Supervisory authority fines can reach 4% of global annual turnover. Beyond the fine, a poorly managed data breach destroys customer trust.
How to implement it: Record processing activities, review contracts with data processors (your cloud provider, your accountant), update the legal notices on your website and define data retention periods.
14. Review of supplier and third-party access
14Audit of supplier and third-party access
What it is: IT providers, consultancies, accountants and external developers who have access to your systems represent a risk if that relationship is not managed correctly.
Why it matters: The SolarWinds attack in 2020 compromised thousands of organisations through a trusted software provider. On a smaller scale, many SMEs have accounts of former employees or former suppliers active for years.
How to implement it: Create named accounts for each supplier (never share the administrator password). Review quarterly which suppliers have active access. When a commercial relationship ends, revoke access on the same day.
15. Periodic security audits
15Annual security audits
What it is: A periodic review of the company's security posture: vulnerability scanning, basic penetration testing, configuration review, regulatory compliance assessment.
Why it matters: Security is not a state, it is a process. Threats evolve, the company grows, new systems are added. An annual audit identifies blind spots before an attacker does.
How to implement it: Free tools like OpenVAS or Nessus Essentials allow basic vulnerability scans. For a complete audit with professional criteria, working with an external provider that brings objectivity and experience is recommended.
Where to start if everything seems urgent
If you have reviewed the checklist and see many points uncovered, do not try to do everything at once. Prioritise by impact:
- First (this week): MFA on email and online banking, verified backup, unique passwords with a manager. These three points eliminate 80% of the most common risk.
- Second (this month): Automatic updates, updated antivirus, laptop encryption, VPN for remote workers.
- Third (this quarter): Anti-phishing training, access policy, basic incident response plan, supplier review.
- Fourth (this year): Complete audit, software inventory, documented GDPR compliance, network segmentation.
Cybersecurity does not have to be perfect to be effective. An opportunistic attacker — which represents the majority of threats for SMEs — will choose the easiest target. If your company has the basic defences active, they will simply look for another target.
Want us to audit your company's IT security?
We identify vulnerabilities, prioritise corrective actions and accompany you through implementation. No jargon, with concrete results.