Digital Security Checklist for SMEs
Cybersecurity for an SME doesn't have to be expensive or complicated. This checklist covers the 20 most important measures you can implement, organized by priority. Many of them are free.
🔴 High priority: implement now
1. Check if your team's emails have been leaked
Use SecuryBlack Breach Scanner to scan your company's corporate emails. If any appear in a breach, change that password immediately.
2. Enable 2FA on all corporate accounts
Email, work tools (Slack, Google Workspace, Microsoft 365), cloud services. No exceptions.
3. Implement a password policy
- Minimum 14 characters
- Unique for each service
- Password manager mandatory (Bitwarden is free)
4. Update all systems
Operating systems, browsers, business software. Security patches fix known vulnerabilities.
5. Enable disk encryption
BitLocker (Windows) or FileVault (Mac) on all company laptops. If a device is lost or stolen, the data is protected.
🟡 Medium priority: implement this month
6. Configure SPF, DKIM, and DMARC
Protect your domain against email spoofing. It's free and your hosting provider can help you.
7. Establish an access policy
- Who has access to what?
- Do former employees still have active access?
- Are shared accounts being used? (they shouldn't be)
8. Set up automatic backups
3-2-1 rule: 3 copies, 2 different media, 1 offsite. Check that you can restore from the backup.
9. Train your team in anti-phishing
A 30-minute session can make the difference. Teach them to identify suspicious emails and not click on dubious links.
10. Review app and service permissions
What apps have access to your Google Drive, calendar, or contacts? Remove the ones you don't use.
11. Secure your office WiFi network
- Strong password (not the router's factory default)
- Separate network for guests
- WPA3 if the router supports it
12. Enable breach monitoring
Register corporate emails on SecuryBlack to receive automatic alerts when they appear in new leaks.
🟢 Low priority: implement this quarter
13. Define an incident response plan
What will you do if you suffer a cyberattack? Who contacts whom? How do you communicate with the team? Document it.
14. Review your insurance policy
Some business insurance policies include cyber incident coverage. If not, consider taking out cyber insurance.
15. Implement business antivirus
Free consumer versions are not sufficient for corporate environments.
16. Set up a firewall
On the office router and on each work device.
17. Audit your GDPR compliance
Do you have a record of processing activities? An up-to-date privacy policy? A breach notification procedure?
18. Use VPN for remote connections
If your team works outside the office, a VPN protects connections on public networks.
19. Run phishing simulations
Send simulated phishing emails to measure how your team responds and detect weak points.
20. Schedule periodic audits
At least once a year, review the entire checklist and evaluate if there are new risks.
Estimated cost of implementing everything
| Measure | Cost | |---|---| | Breach scanner and monitoring | Free (SecuryBlack beta) | | Password manager (Bitwarden) | Free | | 2FA (Google Authenticator) | Free | | SPF/DKIM/DMARC | Free | | Disk encryption | Included in the OS | | Anti-phishing training | 0-500€ | | Business antivirus | 30-50€/device/year | | Cyber insurance | 300-1,000€/year |
Most high-priority measures are completely free.
The first step is the easiest: check your company's emails and tick the first box on this checklist.