It's 9:15 on a Monday and your bookkeeper calls, worried. An email that looked like it came from you asked her to change the bank details on a supplier payment. She almost did it. Meanwhile, your shop's email password is the same one you use for three other accounts, the part-timer who quit in June still has a login to your booking system, and the laptop at the register hasn't been updated since spring. This small business cybersecurity checklist is how you close those gaps in a few short sessions, using tools you mostly already have.
Why Small Shops Get Hit First
Big companies have departments for this. You have you. That's exactly why small businesses get targeted: attackers aren't picking locks, they're trying doors. A reused password from some old leak gets tried against your email. A fake invoice sails through because nobody double-checks payment changes. An ex-employee's login still works because removing it never made anyone's list.
None of those require you to buy anything to fix. They require an hour of attention, in the right order. Email is the master key — whoever controls yours can reset nearly every other password you own — so the checklist starts there.
The Small Business Cybersecurity Checklist, Day by Day
You don't need a free weekend. You need an hour a day for five days.
Day one — lock the email account first. Change your business email password to something long and used nowhere else, then turn on two-step sign-in (sometimes called two-factor authentication) so a stolen password alone isn't enough to get in. Do the same for your banking, your booking system, and anywhere card payments touch. If remembering dozens of passwords is why they all match today, use a password manager — your browser's built-in one is a fine start — and let it generate them.
Day two — run every update you've been postponing. The register laptop, the back-office computer, your phone, the router in the corner. Updates close holes that are already public knowledge, which makes an unpatched machine the easiest target around. Switch on automatic updates everywhere you can, so next month this chore does itself.
Day three — back up, then prove the backup works. Your bookings, invoices, customer list, and records should exist in two places: one copy off the premises or in a cloud account. A backup you've never tested is a hope, not a backup — so restore one file, any file, and open it. If your system died tonight, what matters is that tomorrow you can still see who is booked and who owes you.
Day four — learn the three tells of a phishing email. Check the sender's actual address, not just the display name. Hover over links — or press and hold on a phone — before tapping, and see where they really lead. And set one hard rule for the whole shop: any request to change bank details, send a payment somewhere new, or buy gift cards gets verified by a phone call to a number you already have — never a number from the email itself. Tell your staff the rule out loud — the Monday call ends well only if your bookkeeper knows she won't get in trouble for pausing.
Day five — list who has access to what. Write down every account your business uses and every person who can sign in to each. Remove anyone who no longer works for you, same day, no exceptions. Where a system offers roles, use them: viewing the day's bookings doesn't require the login that can change records or touch billing. This list takes twenty minutes to make and is the most useful page you'll own if anything ever does go wrong.
Disclosure: that is an affiliate link. If you sign up through it, we may earn a commission at no extra cost to you — it's one of the ways this site keeps the lights on. If you'd rather have one tool watch the machines for you — flagging out-of-date software and checking your devices on a schedule — Cyber Suite is worth a look if you run several computers and nobody has time to check them by hand; if it's just you and one laptop, the manual checks above may honestly be all you need.
Where The Mayor Fits — and Where It Doesn't
Plainly: The Mayor is not a security product, and it won't do a single item on this checklist for you. What it does is keep your front desk running while you spend the hour each day doing them. Once your business number is connected, it answers the calls you'd otherwise miss and texts back the ones that slip through, books the job, and gives you the morning rundown — so the chores never cost you a customer who called mid-task and reached nobody. It also follows day five's logic: owners and managers can change customer and appointment records, while only owners and people with the billing role can manage the subscription — access follows the job, not one shared all-powerful login.
The Mayor starts free — the free plan includes 100 replies and 10 voice minutes a month, no card needed. Pro is $99/month, and the founding cohort — the first 25 — locks $79.20/month for life. The full offer is on the plans page.
What This Week Looks Like, as an Example
Here's the checklist running as an example — not a customer story, just the shape of the week for a two-chair barbershop. Monday, the owner changes the shop email password and turns on two-step sign-in between cuts. Tuesday, the register tablet and her phone update over lunch. Wednesday, she copies the booking export and customer list to a cloud folder and opens one file to prove it restored. Thursday, she shows her one employee the "check the real sender address" habit using a junk email from the spam folder. Friday, she removes a former apprentice's login she'd forgotten existed, and writes the access list in the office drawer. Saturday, the shop opens as normal — except five quiet doors are now shut.
Who This Is For — and Who It Isn't
It's for owner-run shops where the same three passwords open everything, staff have come and gone over the years, and the computer stuff lives in one person's head. If that stings a little, this week is yours.
It isn't a complete security program. If you store medical records, run large volumes of card payments through your own systems, or have already had an incident — strange logins, money moved, customers reporting odd emails — skip the checklist and bring in a professional first. A checklist prevents the common problems; it doesn't investigate a live one.
Questions Owners Ask
How long does the whole checklist actually take?
About an hour a day across five days, less if your shop runs on few accounts. If the week goes sideways, do day one and day five first and reschedule the rest rather than dropping them.
Does two-step sign-in really make that much difference?
It's the highest-value item here. Most small business break-ins start with a password that leaked somewhere else. A second step means that password on its own gets an attacker nothing.
Do I still need backups if everything is in the cloud?
Yes. Cloud accounts can be deleted, locked, or signed into by the wrong person just like a laptop can. One copy you control, tested once, is the difference between a bad morning and a lost business. The phone side of the same lesson is in our missed-call cost breakdown.
I found an ex-employee still has access. Now what?
Remove it today, change that account's password if it was ever shared, and note what it could see on your access list. No drama needed; this is routine housekeeping, done late but done.
Start With Day One
Don't print this and pin it to the wall for someday. Open your business email right now, change the password, and turn on two-step sign-in — ten minutes, and the most important door in your business is locked. And if you want the phone covered while you work through the list, see how The Mayor handles your front desk — starting free, on your existing number (free plan: 100 replies a month).
See The Mayor and the founding cohort →
Related reading: How to Answer Business Calls After Hours — Without Sleeping Next to Your Phone — what happens to the calls that come in after closing, and how a text-back in your name covers the night shift.