Stealth Technology Group Team
Most small business cybersecurity checklists are organized around what security vendors sell. They cover antivirus, firewalls, and password managers — the products with the highest awareness — and stop well short of the operational disciplines that determine whether a small business survives a serious security incident or spends six months recovering from one.
This checklist is organized differently. It follows the attack chain — the sequence of steps that attackers actually take when targeting small businesses — and identifies the controls that break that chain at each stage. A small business that works through this checklist won’t have a perfect security posture. Security is never finished. But it will have addressed the specific gaps that result in most small business breaches, in the sequence that produces the most risk reduction per control implemented.
Understand What You’re Actually Protecting
The first and most commonly skipped step in any security program is understanding what assets need protection and why they matter. Small businesses frequently apply generic security controls to everything without understanding which assets represent the most significant risk — and end up under-protecting the things that matter most while spending on protection for things that don’t.
Spend thirty minutes answering these questions before doing anything else on this checklist. What data does your business hold that would cause serious harm if exposed — customer financial information, healthcare records, employee data, client files, proprietary business information? What systems, if unavailable for three days, would prevent you from operating — your email, your accounting system, your customer database, your production environment? What would a ransomware attack on your environment actually cost in downtime, recovery, and reputational damage?
The answers to these questions define your most critical assets and your highest-consequence scenarios. Every control on this checklist is more valuable when it specifically protects those assets and prevents those scenarios rather than being applied uniformly without priority.
For regulated small businesses — defense contractors handling CUI, medical practices handling patient data, legal firms handling client-privileged information — the asset inventory also establishes what regulatory requirements apply and where compliance obligations concentrate. Our guide on CUI identification and marking covers how defense contractors specifically identify what regulated data they hold and where it lives.
Identity and Access Control: The Foundation That Everything Else Depends On
Identity compromise is the initial access technique in the majority of significant breaches. Attackers who obtain valid credentials can navigate environments without triggering malware-based detection, appear to be legitimate users in access logs, and access sensitive data without deploying any exploit. Strong identity controls are the highest-leverage security investment a small business can make.
Enable multi-factor authentication everywhere it can be enabled. This is not optional. MFA on email accounts, cloud platforms, remote access systems, financial applications, and administrative accounts eliminates the vast majority of credential-based attacks. A stolen password without the MFA factor doesn’t produce access. Start with the accounts that have the most access and the highest business impact — email, Microsoft 365 or Google Workspace, your accounting system, your bank accounts — and expand from there. The cybersecurity program guidance that Stealth Technology Group provides specifically addresses MFA implementation for small businesses in regulated industries where credential compromise creates both operational and compliance consequences.
Require strong, unique passwords for every account. A password manager solves the practical problem that prevents people from using unique passwords for every account — it’s impossible to remember fifty unique passwords, but a password manager makes it unnecessary to remember them. Deploy a business-grade password manager for all employees and require that work accounts use generated passwords stored there rather than reused or predictable passwords created by employees.
Apply the principle of least privilege to all user accounts. Every employee should have access to the systems and data their specific job requires — and no more. The administrator who manages your servers doesn’t need access to HR files. The accounts payable clerk doesn’t need access to your source code repository. Mapping access to job function rather than granting broad access by default limits the damage when any individual account is compromised.
Review access rights when people change roles or leave. Terminated employees with active accounts are a persistent vulnerability — and one that’s easy to miss when offboarding is informal. Build account review into every offboarding process: on the employee’s last day, not sometime in the following weeks. Similarly, when someone changes roles, their access should be updated to reflect the new role rather than accumulating permissions from every position they’ve ever held.
Implement privileged access management for administrative accounts. Administrator accounts — accounts with elevated privileges on systems — should be separate from the standard user accounts that administrators use for day-to-day work. An administrator who reads email, browses the web, and uses productivity tools from the same account they use to manage servers is exposing administrative privileges to every phishing email and malicious download that reaches that account.
Protecting the Devices Where Most Attacks Begin
Endpoints — laptops, workstations, mobile devices — are the entry point for the majority of malware-based attacks and the assets most likely to be physically lost or stolen. Endpoint security controls protect both the device itself and the data and credentials it holds.
Deploy and maintain endpoint protection on every managed device. Modern endpoint protection goes beyond traditional antivirus — it includes behavioral detection that identifies malicious activity based on what software does rather than matching signatures, and response capabilities that can isolate a compromised endpoint and terminate malicious processes. Every device that connects to your business systems or stores business data needs endpoint protection deployed and actively managed. The common failure mode — endpoint protection deployed but not monitored, with signature updates that stopped running months ago — provides the appearance of protection without the substance.
Keep all software patched and current. Unpatched vulnerabilities in operating systems, browsers, and applications are among the most commonly exploited attack vectors. Implement automatic updates for operating systems on all endpoints and schedule regular reviews of third-party application patch status — because Windows Update doesn’t patch your PDF reader, your browser extensions, or your productivity software. Our guide on vulnerability management as a service covers how small businesses can manage patching systematically without dedicated security staff.
Encrypt all endpoint storage. BitLocker on Windows, FileVault on macOS — full-disk encryption ensures that a stolen or lost laptop doesn’t produce a data breach. Enable encryption on every business device and verify that it’s active rather than assuming the default configuration enables it.
Control what can connect to business devices. USB drives, external storage devices, and unauthorized software represent data exfiltration and malware introduction risks that endpoint policy controls can address. Define what’s permitted on business devices, enforce that definition through policy or technical controls, and ensure employees understand the boundaries through training.
Establish a clear policy for personal devices. If employees access business systems from personal devices — email on personal phones, VPN access from personal laptops — those devices are part of your security environment whether or not they’re formally managed. Either bring personal devices under a mobile device management policy that enforces security baselines, or restrict access to business systems to company-managed devices where you have full control over the security configuration.
Network Security
Network security for small businesses is simpler than enterprise network security but no less important. The goal is controlling what can reach your systems from the internet, what can communicate between systems inside your environment, and what can leave your environment without authorization.
Secure your perimeter firewall and keep it current. The firewall that sits between your business network and the internet is a critical control that’s frequently configured adequately at installation and then never reviewed. Firewall rules that were added for specific purposes and never removed accumulate into a rule set that allows more traffic than the current security posture should permit. Review firewall rules annually, remove rules that no longer serve an active purpose, and ensure firmware is kept current — perimeter device vulnerabilities are among the most actively exploited by attackers seeking initial access.
Segment your network to limit lateral movement. A flat network where every device can communicate with every other device means that a compromised laptop can directly reach your server, your accounting system, your backup devices, and every other networked resource. Network segmentation that separates different types of systems — separating workstations from servers, isolating IoT devices, creating a guest network for visitors — limits what an attacker can reach from any single compromised device. For defense contractors, network segmentation that isolates the CUI environment from general business systems is a CMMC compliance requirement with direct security benefit.
Eliminate or restrict remote access to minimum necessary. Remote desktop protocol exposed directly to the internet is one of the most consistently exploited small business vulnerabilities — attackers scan for it continuously and attempt to authenticate with credential lists. If remote access to business systems is necessary, require it to occur through a VPN with MFA rather than direct RDP or other remote access protocols exposed to the internet. Audit what remote access paths currently exist and close any that aren’t actively needed.
Monitor DNS and web filtering. DNS-based web filtering blocks access to known malicious domains before connections are established — preventing malware command-and-control communications, blocking phishing sites that harvest credentials, and stopping malicious file downloads before they reach the endpoint. This is a low-cost control with high defensive value that prevents many attack techniques at the earliest stage.
Email Security: Protecting the Channel Where Most Attacks Arrive
Email is the delivery mechanism for the majority of initial compromise attacks — phishing emails that harvest credentials, malicious attachments that deliver malware, business email compromise attacks that redirect payments. Email security controls that reduce the effectiveness of these techniques at the delivery layer prevent the compromises that endpoint and identity controls would otherwise need to catch.
Enable all available email authentication mechanisms. SPF, DKIM, and DMARC are email authentication standards that prevent spoofing of your domain and help receiving mail servers identify fraudulent emails claiming to be from your organization. SPF specifies which mail servers are authorized to send email from your domain. DKIM cryptographically signs emails to confirm they weren’t modified in transit. DMARC specifies what to do with emails that fail SPF and DKIM checks and provides visibility into how your domain is being used. All three should be configured correctly — and verifying that they are is a five-minute exercise using free online checking tools.
Deploy email filtering that goes beyond basic spam filtering. Modern email security platforms evaluate attachments and links in emails against threat intelligence, sandbox suspicious attachments before delivering them, and identify phishing attempts based on content analysis and sender reputation rather than just spam pattern matching. The native filtering in Microsoft 365 and Google Workspace is a reasonable baseline, but organizations handling sensitive data — defense contractors, healthcare providers, legal firms — benefit from additional email security layers that provide deeper threat analysis.
Train employees to recognize phishing — and test that training. Security awareness training that includes phishing awareness and periodic phishing simulations produces measurable behavior change. Employees who have clicked on simulated phishing emails in training are better prepared to identify real phishing attempts than those who have only read policy documents. The combination of training and simulation is specifically required under CMMC’s Awareness and Training domain, and it’s one of the highest-return security investments for small businesses regardless of regulatory requirements.
Backup and Recovery
Ransomware recovery outcomes are determined almost entirely by the backup architecture in place before the attack. Organizations with tested, ransomware-resilient backups recover within days. Those without adequate backups face weeks of recovery or worse — the choice between paying ransom and permanent data loss.
Follow the 3-2-1-1 backup rule. Three copies of critical data, on two different media types, with one copy offsite, and one copy offline or immutable. The offline or immutable copy is what survives ransomware — attackers specifically target network-accessible backups, and backups that can’t be reached through network connections can’t be encrypted or deleted. Our dedicated guide on backup services for business covers how to build backup architecture that actually survives ransomware.
Test your backups through actual recovery. Running backup jobs produces backup files. Testing backup recovery produces verified recovery capability. These are different things. Restore a non-critical system from backup in a test environment at least annually and verify that the restored system is actually functional. Backup monitoring that only confirms job completion without verifying recoverability produces false confidence that only becomes visible during an actual incident.
Define and verify your recovery time objective. How long can your business operate without access to specific systems? The answer defines the recovery time your backup architecture needs to achieve — and that target needs to be verified through testing, not estimated from backup specifications. An organization that assumes it can recover in 24 hours but has never tested recovery may discover the actual timeline is four days, which is a very different business continuity picture.
Separate backup credentials from primary environment credentials. Backup administrator accounts that use the same credentials as other IT systems are accessible to attackers who compromise those systems. Separate backup management accounts with unique credentials, stored separately, prevent primary environment compromise from automatically compromising the backup infrastructure.
Security Monitoring: Knowing When Something Is Wrong
Security monitoring is the function that converts the events that other controls generate into actionable detection — identifying when an attack is underway rather than discovering it after the damage is done.
Centralize and retain logs from critical systems. Every critical system in your environment generates security-relevant logs — authentication events, access to sensitive data, configuration changes, network connections. Those logs need to be centralized somewhere they can be reviewed, retained long enough to support incident investigation, and protected against modification that would allow an attacker to cover their tracks. For CMMC-regulated organizations, the log generation, retention, and review requirements are specific compliance obligations with evidence standards attached.
Review logs regularly — not just when something breaks. Log review is the control that converts log generation into actual security awareness. Weekly review of authentication logs looking for failed login patterns, access outside normal business hours, or logins from unusual geographic locations identifies compromise indicators that automated alerting alone misses. The managed SOC service providers guide covers how small businesses can access professional security monitoring without building an internal security operations function.
Monitor for dark web exposure of your credentials. Services that monitor dark web marketplaces for credential sets matching your domain provide early warning when employee credentials have been compromised and are available for purchase by attackers. Knowing that credentials have been exposed before an attacker uses them provides the opportunity to rotate passwords and implement additional controls proactively rather than reactively.
Incident Response
The difference between organizations that handle security incidents well and those that handle them badly is almost entirely preparation. Organizations with practiced incident response plans contain incidents faster, limit damage more effectively, and satisfy regulatory notification requirements on time. Those without plans discover their response process during the incident — the most expensive time to figure it out.
Document your incident response procedures before an incident occurs. Who gets called first when a security incident is suspected? Who has the authority to take systems offline to contain an attack? Who notifies affected parties if data is compromised? Who contacts law enforcement if required? These questions need answers that are documented and communicated before an incident, not decided under time pressure while one is active.
Test your plan through a tabletop exercise annually. A tabletop exercise walks key stakeholders through a realistic incident scenario — ransomware, data breach, business email compromise — and identifies gaps in the response process under simulated conditions rather than real ones. For defense contractors, the 72-hour DoD reporting requirement under DFARS 252.204-7012 means the notification procedure specifically needs to be practiced — because 72 hours is an unforgiving window that leaves no time for figuring out the reporting process during the incident.
Know your regulatory notification obligations before you need them. Every regulated industry has specific breach notification requirements. HIPAA has specific timelines and content requirements for breach notification to affected individuals and HHS. State breach notification laws apply to consumer data breaches in most states. CMMC-governed organizations have the 72-hour DoD reporting requirement. Knowing what’s required and having the process ready means notifications happen on time rather than after the deadline has passed.
Vendor and Supply Chain Security
Third-party vendors with access to your systems or data are security risks that your own controls don’t directly address. A vendor with administrative access to your environment who has inadequate security practices is an entry point into your systems that bypasses every perimeter control you’ve implemented.
Audit who has access to your systems from outside your organization. Your managed IT provider, your software vendors who provide remote support, your cloud service providers — every external party with access to your environment needs to be inventoried and evaluated. Access that was granted for a specific purpose that’s no longer active should be revoked. Access that remains active should be governed by MFA and logging requirements equivalent to what you apply to your own staff.
Review vendor security practices and contractual obligations. Vendors who handle your sensitive data should have contractual obligations around how they protect it, how quickly they notify you of security incidents affecting your data, and what security standards they maintain. Generic vendor agreements that don’t address these obligations leave you with exposure when a vendor incident affects your data. Our guide on how third-party vendors affect CMMC compliance covers vendor risk management for defense contractors specifically, but the principles apply to any organization with vendors accessing sensitive systems.
CMMC and Regulatory Compliance
For small businesses subject to specific regulatory frameworks, the controls above satisfy many compliance requirements — but regulatory compliance has additional documentation and evidence requirements that go beyond implementing controls.
CMMC Level 1 requires 17 basic security practices and annual self-attestation in SPRS. If your defense contracting work involves only FCI and not CUI, Level 1 compliance is achievable without the full CMMC Level 2 investment. CMMC Level 2 requires all 110 NIST SP 800-171 practices with formal C3PAO assessment for most contractors. Understanding which level applies to your specific contracts is the prerequisite for building the right compliance program. Our CMMC Level 1 vs Level 2 guide covers how to make that determination.
For small businesses approaching CMMC for the first time, a CMMC gap analysis establishes where you currently stand against applicable requirements and what the remediation roadmap looks like. The CMMC requirements for small businesses guide specifically addresses how mid-market and small business contractors can navigate compliance without the resources of a large prime.
Putting the Checklist Into Practice
Working through this checklist comprehensively takes time that most small businesses don’t have in surplus. Sequencing matters — some controls prevent more attacks than others, and some provide foundation that other controls build on.
Start with identity: MFA everywhere, password manager deployment, and access rights aligned to job function. These three actions prevent the majority of credential-based initial access attacks and require minimal ongoing maintenance once implemented.
Add endpoint protection and patching as the second layer. Endpoint protection catches the attacks that get past identity controls. Current patching eliminates the vulnerabilities that exploitation-based attacks depend on. Together, these two controls address the dominant attack vectors.
Implement backup and recovery as the third priority. Even with strong identity and endpoint controls, breaches happen. Verified, ransomware-resilient backup is what determines whether a breach becomes a recoverable incident or an existential one. Build email security and security awareness training as the fourth layer. These controls address the delivery mechanism for most attacks — phishing emails — and the human behavior that determines whether those attacks succeed.
Add monitoring, incident response planning, and vendor governance as the fifth layer. These controls convert the visibility and resilience created by earlier layers into a complete security program that detects, contains, and recovers from the incidents that the earlier controls don’t prevent.
Organizations in Boston, Tampa, and Sarasota that need help working through this checklist systematically — particularly those with CMMC compliance requirements attached — can engage the compliance and managed IT services teams at Stealth Technology Group to conduct a gap assessment, build the remediation roadmap, and implement controls with the compliance evidence production that regulated businesses require. The co-managed IT model works particularly well for small businesses with some internal IT capability that needs to be extended rather than replaced.
Conclusion
This checklist covers the controls that matter most for small business security — the ones that address how attacks actually happen rather than what security vendors happen to sell. Working through it systematically produces a meaningfully better security posture than most small businesses currently have.
But security isn’t a project that ends when the checklist is complete. Threats evolve. Technologies change. The business environment shifts in ways that introduce new risks. The checklist produces a foundation; maintaining it as an operational discipline is what produces lasting security. If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.
