A practical security baseline for a small team.

If someone takes over your email, they may be able to reset other passwords. Start with email, banking, payroll, cloud storage, and your domain registrar.

• Turn on multi-factor authentication (MFA). It asks for another proof of identity after a password. Use an authenticator app, passkey, or security key when available; any MFA is better than a password alone.
• Use a password manager to make a different, hard-to-guess password for each account. Do not reuse your email password anywhere else.
• Save recovery codes somewhere safe that is separate from the account they unlock. Check that a second trusted person knows how to reach them if the owner is away.

Updates often fix known security problems. A laptop that misses updates for months can become an easy path into business files.

• Turn on automatic updates for computers, phones, browsers, office apps, and the router. Restart devices when an update needs it.
• Replace software and devices that no longer receive security updates, or ask your IT provider for a safe replacement plan.
• Use screen locks and device encryption where available, especially on laptops that leave the office.

A backup only helps if it is current, protected from the same incident, and possible to restore.

• List the files and systems you could not run the business without: bookkeeping, customer records, shared files, and website data.
• Keep a backup that an everyday account cannot quietly delete. Limit who can change it and turn on multi-factor authentication for the backup account.
• Pick one file and practice restoring it. Write down who can restore the rest and where to find the instructions.

A polished email or text can still be fake. A familiar name is not proof that the sender or payment details are genuine.

• Before paying a new account or changing bank details, confirm the request using a phone number or contact method you already trust.
• Do not sign in through an unexpected link. Open the service from a saved bookmark or type its address yourself.
• Give staff a simple way to report suspicious messages. Thank people for reporting early, even when a message turns out to be legitimate.

Small teams often share accounts for convenience. Individual accounts make it easier to see who has access and remove it when roles change.

• Use individual accounts instead of shared logins wherever possible. Give administrator access only to the people who need it.
• When someone leaves or changes roles, remove old access to email, cloud files, banking, website tools, and vendor accounts.
• Keep a short list of important vendors, support contacts, and the person responsible for each account.

Websites, domains, and forgotten test systems are part of your business’s public footprint. A simple inventory helps your team spot what no longer belongs there.

• List your domains, subdomains, websites, and remote-access tools. Ask your web host or IT provider to help if the list is unclear.
• Change default administrator passwords on routers and remote-access tools. Turn off remote access you do not use, and limit required access to approved people and devices.
• Review changes to your public-facing systems regularly. Caskveil can help you see external exposure signals for domains you own or are authorized to assess.