By the Tuncer Technologies team ·
Most attacks on small businesses are not clever. They use stolen passwords, unpatched software, fake invoices and phishing emails. The good news is that the basics stop a large share of them, and most of the basics cost little or nothing.
This checklist is written for owners, not IT departments. Work through it this month, one item at a time. Government agencies publish free guidance too: CISA in the United States, the Australian Cyber Security Centre (cyber.gov.au) in Australia, and the National Privacy Commission on data protection in the Philippines.
The 12-point checklist
1. Turn on multi-factor authentication (MFA)
Start with email, banking, your website admin, accounting and social media. MFA means a stolen password alone is not enough. Prefer an authenticator app over SMS where you can.
2. Use a password manager
One strong, unique password per account. A password manager makes this realistic for staff.
3. Remove old accounts
Former staff, old contractors and shared logins. If you do not know who uses an account, find out or close it.
4. Update everything
Computers, phones, routers, website software and plugins. Turn on automatic updates where possible. Replace devices that no longer receive updates.
5. Back up, and test the restore
Keep at least one backup that is not permanently connected to your network or main cloud account. A backup you have never restored is only a hope.
6. Protect your devices
Use the built-in protection on Windows and macOS or a reputable endpoint product, with screen locks and disk encryption turned on.
7. Secure your business email
Set up SPF, DKIM and DMARC on your domain so criminals cannot easily send email pretending to be you.
8. Verify payment changes by phone
Fake invoices and "we changed our bank details" emails are among the most costly scams. Call a known number before you change any payment details.
9. Train your team in 15 minutes
Show real examples of phishing. Make it easy and blame-free to report a suspicious email.
10. Limit admin rights
Daily work should not happen in an administrator account. Give each person only the access they need.
11. Secure your website
HTTPS everywhere, updated software, strong admin logins with MFA, and a backup you can restore.
12. Write a one-page incident plan
Who to call, how to disconnect a device, where backups are, and how to contact your bank. In the Philippines, organisations covered by the Data Privacy Act may need to notify the National Privacy Commission of certain breaches, so know your obligations before something happens.
Where to start if you only have one hour
If this list feels like a lot, do these three things today:
- Turn on MFA for your main business email account and your bank.
- Check that your computers and phones have the latest updates installed.
- Confirm you have a recent backup of your most important files, and that it is stored somewhere separate.
Then put one checklist item a week into your calendar. In three months you will be far harder to attack than most businesses your size, without buying anything expensive.
What this does not cover
A checklist is a starting point, not a guarantee. Regulated industries, businesses handling large amounts of personal or payment data, and anyone who has already been attacked need a proper review by a specialist.
How we can help (Tuncer Technologies)
Prices are as of 23 October 2026; the checkout always shows the current price.
| Item | What you get | USA / Australia | Philippines |
|---|---|---|---|
| MFA/access configuration (/store/S02) | Up to 10 accounts on one supported platform | USD 199 | PHP 5,000 |
| Endpoint protection setup (/store/S03) | Up to 10 endpoints, standard policy configuration | USD 299 | PHP 7,500 |
| Backup configuration (/store/C04) | One system, retention policy and restore test | USD 299 | PHP 7,500 |
| Security configuration review (/store/S01) | One small site or cloud environment, configuration report | USD 599 | PHP 15,000 |
| Remote malware and virus cleanup (/store/S11) | One computer: scan, cleanup and recheck, up to 2 hours | USD 99 | PHP 3,000 |
| Security maintenance (/store/S14) | Scheduled permission and log review, updates, up to 3 hours a month | USD 249 / month | PHP 6,000 / month |
If you think you are being attacked right now, disconnect the affected device from the network, contact your bank if money is involved, and ask us for security incident response, which is quoted after triage.
Start with MFA/access configuration
Want a quick look at your website first? Our free website audit checks HTTPS and other technical basics.
FAQ
What is the most important cybersecurity step for a small business?
Turning on multi-factor authentication for email and financial accounts. Email is the key to resetting almost every other account.
How much does cybersecurity cost for a small business?
The basics in this checklist are mostly free or low-cost. Help with setup from us starts at USD 199 (PHP 5,000) for MFA and access configuration on one platform.
Is antivirus enough?
No. Antivirus helps, but most incidents start with stolen passwords, phishing or unpatched software. Combine device protection with MFA, updates and backups.
Do small businesses really get targeted?
Yes. Many attacks are automated and look for any weak password or outdated software, regardless of company size.
Can you guarantee we will not be hacked?
No honest provider can. Good basics greatly reduce your risk, and a tested backup and incident plan reduce the damage if something happens.