A Cybersecurity Checklist for Businesses
Cybercriminals don’t discriminate by company size. 43% of cyberattacks target small and midsize businesses (“SMB”), and 88% of SMB breaches involve ransomware. The average data breach now costs US organizations $10.22 million. This checklist, prepared by Veronica Canton, Partner with Pierson Ferdinand LLP’s Cyber, Privacy & Technology team, provides practical, everyday actions organizations can take to make cybercriminals’ jobs harder.
Your First Line of Defense: People
Designate a Security Program Manager. This person doesn’t need to be a security expert, but someone who ensures cybersecurity stays on the leadership agenda (CISA Cyber Essentials).
Conduct cybersecurity awareness training at least quarterly. Include AI-generated phishing scenarios that reflect 2026 threats, not outdated templates.
Run phishing simulations that mirror real attack patterns. Test with realistic, contextual lures, not obvious red flags.
Establish a clear, no-blame reporting culture. Every employee should know exactly who to contact and what to do when something looks suspicious.
Require out-of-band verification for all financial transactions. If someone requests a wire transfer by email, video call, or voicemail, verify through a separate trusted channel before acting (deepfakes are real).
Lock Down Access
Enable multi-factor authentication (MFA) on every account. This includes email, cloud storage, financial systems, VPNs, and administrative portals. CISA reports MFA blocks 99% of automated attacks.
Use unique, complex passphrases for every account. Deploy an enterprise password manager to make this practical.
Review and remove unnecessary user access quarterly. Former employees, contractors, and unused service accounts can be open doors to cybercriminals.
Implement role-based access controls. Employees should only access the data and systems their roles require.
Disable default and shared administrator credentials. Do this on all devices and systems.
Protect Your Systems
Keep all software, operating systems, and firmware updated. Enable automatic updates where possible; unpatched vulnerabilities are a top attack vector.[1]
Back up critical data regularly using the 3-2-1 rule. 3 copies, 2 different media types, 1 offsite. Also, don’t forget to test your backups to confirm they actually restore.
Encrypt sensitive data at rest and in transit. Encryption significantly reduces exposure if data is stolen.
Segment your network. An incident impacting one area should not give attackers access to everything.
Install and maintain endpoint detection and response (EDR). It is recommended to have EDR on all devices, including employee laptops and mobile devices that access company data or systems.
Prepare For The Worst
Create a written Incident Response Plan (IRP). Document who does what, when, and how during a cyber incident.
Run tabletop exercises at least twice a year. Practice your IRP with leadership so it works under real pressure, not just on paper.
Know your breach notification obligations. With 20 state privacy laws and all 50 states having breach notification requirements, response timelines vary and overlapping obligations are common.
Identify your legal counsel BEFORE an incident. Having an attorney experienced in cybersecurity and data privacy on speed dial reduces response time and protects privilege.
Review your cyber insurance coverage annually. Confirm it covers ransomware, business email compromise (“BEC”), incident response costs, and understand your policy’s conditions and exclusions.
Know Your Data
Conduct a data inventory. Know what personal data you collect, where it’s stored, who has access to it, and how long you retain it. You can’t protect what you can’t see.
Implement a data minimization practice. Collect only what you need, delete what you don’t, and stop storing data “just in case.”
Review and update your privacy policy at least annually. Ensure your privacy policy accurately reflects your current data practices and complies with applicable state laws.
Assess your vendor and third-party risk. Your cybersecurity is only as strong as your weakest vendor. Review contracts, require security standards, and monitor compliance.
75% of SMB owners rank cyberattacks as their #1 operational threat in 2026. 40% say an attack costing $100,000 or less could put them out of business. The good news: the steps on this checklist are practical, affordable, and proven to reduce your risk. Start with the basics, which include MFA, backups, and training.
Sources: CISA Cyber Essentials | NIST Cybersecurity Framework 2.0 (SP 1300) | Verizon 2025 DBIR | IBM Cost of a Data Breach Report 2025
Need help implementing these steps? Reach out to Veronica Canton (veronica.canton@pierferd.com) and the Pierson Ferdinand Cyber, Privacy, & Technology team. Veronica advises clients on cybersecurity incident preparedness and incident response, data privacy, and artificial intelligence governance.
This publication and/or any linked publications herein do not constitute legal, accounting, or other professional advice or opinions on specific facts or matters and, accordingly, the author(s) and PierFerd assume no liability whatsoever in connection with its use. Pursuant to applicable rules of professional conduct, this publication may constitute Attorney Advertising. © 2026 Pierson Ferdinand LLP.
[1] Vector: specific method or entry point used to gain unauthorized access to a computer network, system, or device.
