Security awareness checklist for small business (free)

Here is a security awareness checklist for small business that you can copy into a document today. Mark each item Done, In progress, or Not yet. Put a name and a date next to each.

The first five (marked first) matter most.

What is a security awareness checklist?

It is a short list of habits and records that make your team harder to trick. It covers four groups, so work through them in order.

People

1. first Every new hire gets a security lesson in week one.
2. Every person gets a short lesson at least every month or two. See how often to train.
3. Everyone knows the four signs of phishing. See CISA’s list.
4. first There is one way to report a suspicious message, and a named person who answers.
5. Reporting is no-blame, and people hear “thank you.”
6. Safe practice phishing tests run on a schedule. Free test.

Accounts

7. first Multi-factor authentication is on for email and admin accounts. How-to.
8. Everyone has their own login. No shared passwords.
9. A password manager is available to all staff.
10. Staff know not to share one-time codes or OTPs with anyone.
11. Leavers lose access on their last day.

Money

12. first Bank detail changes need a call to a known number and a second person. See BEC.
13. Large payments need two approvals.
14. Staff know gift card and urgent transfer requests are a red flag.
15. Finance staff have extra training on invoice fraud.

When something goes wrong

16. first Everyone knows who to tell first and how.
17. Staff know not to delete evidence. See what to do after a click.
18. You have a short written plan and contact list for incidents.
19. You know your breach notice rules. In Nigeria, see the NDPA 72 hour plan.
20. You keep training records: who, what, when. See what auditors ask for.

How do you use this checklist?

Copy it, assign owners, set dates, and review it every quarter.

• Copy it into a shared sheet.
• Add an owner and a due date to each line.
• Do the five “first” items this week.
• Review it every quarter. Save a dated copy as proof.

A worked example: a 12-person office

A 12-person accounting office picks its office manager as the owner. In week one she turns on MFA for email, writes one line on the wall (“Suspicious message? Send it to her, and she says thank you”), and sets a two-person rule for bank changes. In week two she books a 15-minute lesson for everyone. By the end of the month she has items 1 to 5 done and dated. That is a real, provable start.

Common mistakes

• Doing the checklist once and never again.
• Having no owner, so nothing gets done.
• Training only the IT person.
• Skipping the money group, where small firms lose the most.
• Not saving dated copies, so you cannot show proof later.

NIST also advises teaching employees to spot phishing, report incidents and keep training regular. See NIST’s small business phishing guidance.

Need help running it?

Our platform delivers short lessons, tracks who finished, and runs safe phishing tests. See the courses, the phishing simulation program and pricing, or request a free test. Working with a practice that handles client data? See our pages for CPA and tax firms and dental and medical offices.

To keep and show records, read how to track employee training completion on Skillermatic.