Most small businesses in Marquette do not get breached by a movie-style hacker. They get hit because a password was reused, a laptop missed updates for a year, or nobody checked who still had access to the shared drive after an employee left. Retail shops, construction firms, real estate offices, restaurants, hotels, and medical practices around the Upper Peninsula all run on the same handful of systems: email, cloud files, Wi-Fi, phones, and a few networked devices. A checklist keeps those basics from slipping when the busy season hits. The list below is written to be worked through in order, with the highest-risk items first.
1. Build an Account and Device Inventory
You cannot protect what you have not counted. Walk through the office and write down every laptop, desktop, tablet, printer, camera, phone, and server. Then list the services those devices connect to: email, file sharing, accounting, scheduling, payment processing, and the phone system. For each one, record who holds the admin login and whether that person still works there. A complete account and device inventory is one of the most frequently recommended first steps in published small business checklists, and it anchors everything that follows. Without it, you are guessing at your own exposure.
2. Fix Passwords Before Adding Anything Else
Short, clever passwords with symbols swapped in are not actually strong, and staff who need to remember fifteen of them will start reusing a few. Longer passphrases are easier to remember and harder to crack. A password manager does the heavy lifting by generating and storing unique credentials for each service.
- Give every employee their own login instead of a shared office account.
- Require unique passwords for email, banking, and anything with admin rights.
- Favor long passphrases over short strings with substitutions.
- Store credentials in a password manager, not in a spreadsheet or a notebook.
- Retire logins for former employees and old vendors on the same day they leave.
3. Turn On Multifactor Authentication
Multifactor authentication, usually called MFA, is the single control that stops the most account takeovers. Even if a password leaks, the attacker still needs the second factor. Turn it on for email first, then for banking, remote access, and any administrative console tied to your network or phone system. Text message codes are better than nothing, but authenticator apps and hardware keys are stronger options. If a vendor you rely on does not offer MFA, ask why and note the answer in your inventory.
4. Patch Devices and Review Firewall Settings
Software updates close holes that attackers already know about. An unpatched machine is not a future problem, it is a current one. Set operating systems, browsers, and line-of-business software to update automatically where possible, and check monthly that the updates actually installed. On the network side, review your firewall configuration, confirm security subscriptions are current, and check that remote administration is not exposed to the open internet. Domain name system filtering is another low-effort layer that blocks known malicious destinations before staff click them.
5. Check Your Wi-Fi and Remote Access
Guest Wi-Fi should be separated from the network that carries your point-of-sale, file shares, and cameras. Change default router administrator credentials, use a modern encryption standard, and rotate the guest password when it spreads too far. If staff or owners connect remotely, review who has access and shut off accounts that are no longer needed. Remote access tools are convenient for attackers too, so every entry point deserves a name, an owner, and a review date.
6. Lock Down Email
Email remains the most common way a small business gets compromised. Most attacks arrive as a message that looks routine: an invoice, a shipping notice, a request to confirm a password. Configure spam and phishing filtering, enable MFA on every mailbox, and set up alerts for unusual sign-ins such as a login from an unfamiliar location. Watch for payment change requests that appear to come from a known vendor or a manager, and require a phone call confirmation before any wire or payment detail change is processed.
7. Review Access Controls on a Schedule
Access drifts. People change roles, contractors finish projects, and shared passwords spread quietly across a team. A quarterly review keeps that drift in check and takes less than an hour once you have an inventory.
| What to review | What to confirm |
|---|---|
| User accounts | Every active account belongs to a current employee or contractor |
| Administrator rights | Only the people who truly need admin access have it |
| Shared mailboxes and drives | Permissions match current roles, not last year’s roles |
| Third-party access | Vendors with remote access still need it, and the scope is limited |
8. Test Your Backups, Not Just Your Backup Schedule
A backup that has never been restored is a hope, not a plan. Confirm that critical data is backed up on a regular schedule, that at least one copy sits somewhere separate from your main systems, and that someone has actually performed a test restore. Keep an offline or immutable copy as well, since ransomware is designed to encrypt anything the infected machine can reach. Write down how long a restore would take, because that number tells you how long your business could be closed.
9. Train Staff on Phishing and Reporting
Your team is the front line, but only if they know what to look for and have a painless way to report it. Short, regular training beats a single annual session nobody remembers. Cover how to spot a suspicious sender address, why urgency and secrecy are red flags, and what to do when a message feels wrong. Make reporting blame-free so people speak up quickly instead of hiding a mistake. Staff training appears on nearly every solid small business checklist for good reason.
10. Talk Cybersecurity With Your Vendors
Your risk includes the companies that touch your data. Ask your payment processor, cloud software provider, payroll service, and IT vendor what safeguards they maintain and how they would notify you of an incident. Keep a list of who has access to what, and remove that access when the relationship ends. These conversations feel awkward the first time and become routine after that.
11. Write Down an Incident Response Plan
When something goes wrong, panic costs time. A one-page plan removes guesswork.
- Name who calls whom, including your IT contact and your insurer.
- Describe how to isolate an affected device without destroying evidence.
- List the accounts to reset and the systems to check first.
- Keep an offline copy of critical contacts and recovery steps.
- Set a rule for who speaks to customers and staff.
- Review the plan after any scare, even a false alarm.
A Workable Order of Operations
You do not need to finish all of this in a week. The sequence below keeps momentum without overwhelming a small team.
| Phase | Focus |
|---|---|
| First 30 days | Complete the account and device inventory, deploy a password manager, review Wi-Fi and remote access, and start phishing training |
| Next stretch | Enable MFA everywhere it is offered, confirm patching is working, test a backup restore, and contact vendors |
| Ongoing | Quarterly access reviews, annual policy review, refresher training, and an incident plan walkthrough |
Where Local Support Fits
Plenty of Marquette owners can handle the inventory and password manager on their own, then stall on firewalls, patching, and backup testing because those tasks need someone watching them consistently. Superior Eagle Inc. works with small businesses across the Upper Peninsula on managed IT services, business phone systems, security cameras, and structured wiring. That means the checklist items touching your network, your VoIP phones, and your camera system can be handled by the same local team that already knows your building, rather than a national provider reading from a script. If you would rather verify a specific requirement against an official source, such as a cyber insurance questionnaire or a compliance obligation for your industry, check with that body directly before assuming a checklist item covers it.
Frequently Asked Questions
How often should a small business run through this checklist?
Work the full list once to get your baseline, then revisit the access review, patching, and backup testing every quarter. The inventory should be updated whenever someone is hired or leaves, and the incident response plan deserves a read-through at least once a year. Cybersecurity is less about one big project and more about small checks that keep happening on a rhythm.
Is multifactor authentication really necessary for a small shop?
Yes. MFA is one of the highest-value protections available to a small business because it blocks the most common account takeover path, a stolen or guessed password. It matters most on email, banking, and administrative consoles. Most providers now offer it at no extra cost, so the effort is usually a one-time setup rather than an ongoing expense.
Do security cameras and VoIP phones belong on the checklist?
They do. Cameras, phones, printers, and other networked devices often ship with default credentials and firmware that rarely gets updated. Add each one to your inventory, change the default password, keep firmware current, and place them on a separate network segment from your financial and file systems where possible. Devices that are forgotten are devices that stay vulnerable.
What should we do first if we suspect a breach?
Disconnect the affected device from the network without wiping it, then contact your IT support and your insurer using the numbers in your incident plan. Change passwords for exposed accounts from a clean device, and watch for unusual email activity or payment requests. Avoid paying ransom demands or negotiating without guidance, and document what you observed while the details are still fresh.