A fraudulent invoice, a reused password, or an old website plugin can create a business problem long before it looks like a cybersecurity problem. This Erie business cybersecurity checklist is built for local owners and managers who need practical controls around email, payments, customer information, and the systems their teams use every day.
The goal is not to turn a small business into an enterprise security department. It is to reduce the avoidable gaps that criminals look for, give your team clear habits to follow, and make recovery possible when something goes wrong. Start with the systems that can interrupt revenue, expose customer information, or give someone access to your accounts.
Start With the Accounts That Run the Business
Most security incidents begin with access. A former employee still has a login. A shared password sits in a spreadsheet. An owner has the only administrator account and cannot get into it after changing phones. Before buying another tool, get a clean picture of who can access what.
1. Inventory critical accounts
Make a simple list of every account tied to operations: business email, website hosting, domain registration, payment processing, accounting, scheduling, cloud storage, social media, CRM, phone system, and any software that stores customer or employee data. Identify the account owner, the billing contact, and the recovery email or phone number for each.
This is especially important when a business has changed web vendors, staff, or software over time. A website can be updated and still be vulnerable if the domain registration or hosting account is controlled by an old personal email address.
2. Turn on multi-factor authentication
Multi-factor authentication, often called MFA, should be enabled on every critical account that supports it. Email comes first because email resets passwords for nearly everything else. After that, prioritize banking, payment platforms, domain accounts, cloud storage, and administrator logins for your website.
An authenticator app is generally stronger than text-message codes, although text messages are still better than relying on a password alone. The trade-off is convenience. Give your leadership team a clear setup process and securely store backup recovery codes so a lost phone does not become a lockout.
3. Replace shared and reused passwords
Each employee should have an individual login for the systems they use. Shared logins make it difficult to remove access when someone leaves and nearly impossible to determine who changed a setting or approved a transaction.
Use a password manager to create unique, long passwords and share credentials only when a system does not support individual accounts. A password manager takes some adjustment, but it is far safer than sending passwords through text messages, email, or handwritten notes near a workstation.
Protect the Workflows Criminals Target
Small businesses are often targeted through routine work, not technical tricks. A convincing email asks an employee to pay a vendor, change direct-deposit information, open an attachment, or buy gift cards for a manager. The request may look ordinary because it is based on information found online or taken from a compromised mailbox.
4. Add a payment-verification rule
Create a written rule for payment changes and unusual transfers. If a vendor sends new banking information, staff should verify it using a known phone number from your records, not a number in the email. The same goes for urgent requests that appear to come from an owner or manager.
A second person approving higher-risk payments may feel slower, but it creates a useful pause. For a small team, the rule can be simple: no bank detail changes, wires, or unexpected invoices are processed without a call-back verification.
5. Train employees on realistic phishing signs
Annual training alone is not enough if nobody discusses actual situations. Review examples relevant to your operation: fake package notices, document-sharing alerts, payroll requests, account-expiration messages, and vendor invoices. Teach employees to pause when a request is urgent, secret, or financially unusual.
Employees also need a low-friction way to report suspicious messages. They should know they will not be blamed for asking before clicking. Fast reporting can prevent one questionable email from becoming a larger issue across the business.
6. Keep work devices current and protected
Computers, phones, and tablets used for business should receive operating system and application updates promptly. Turn on automatic updates where practical, require screen locks, and use separate work profiles or accounts when devices are shared.
Remote work adds another decision point. If employees access business email or files from personal devices, define what is allowed and what happens if the device is lost. It may be appropriate to limit access rather than attempt to manage every personal device. The right approach depends on the sensitivity of the information involved.
7. Remove access when roles change
Offboarding is a security task, not just an HR task. When an employee, contractor, or vendor relationship ends, remove access to email, cloud drives, website administration, scheduling systems, and other business tools promptly. Change shared passwords if they had access to them.
Review access quarterly as well. Employees often accumulate permissions as they take on temporary duties, and those permissions tend to remain long after the task is finished.
Use This Erie Business Cybersecurity Checklist for Your Website
Your website may be a marketing tool, but it is also connected to forms, email notifications, customer data, analytics, hosting, and sometimes payments. A neglected site can create an opening into other parts of the business or damage customer trust.
8. Keep the website platform and plugins maintained
If your site uses WordPress or another content management system, updates matter. Core software, themes, plugins, and server software should be reviewed on a regular schedule. Remove plugins and themes that are no longer in use rather than leaving them installed indefinitely.
Updates should be handled carefully on custom or older sites. Applying every update without testing can break a form, checkout process, or integration. A sensible website care process includes backups, staging or testing where appropriate, and someone accountable for checking that key functions still work after changes.
9. Review website forms and customer data
Ask what every form collects and why. A basic contact form usually does not need a Social Security number, banking information, or other highly sensitive details. Collect only the information needed to respond to a request or provide a service.
Make sure form notifications go to an actively monitored business mailbox, not a former employee’s inbox. Limit who can download form submissions or access customer data in the site dashboard. If sensitive information must be collected, the process deserves a more specific technical review.
10. Secure the domain, hosting, and backups
Your domain name is a critical business asset. Enable MFA on the registrar account, confirm ownership details are current, and keep renewal notices from going to an abandoned email address. Domain loss can take down your website and disrupt business email.
Backups need similar attention. Confirm that website backups run automatically, are stored somewhere separate from the live website, and can actually be restored. A backup that has never been tested is an assumption, not a recovery plan.
11. Review vendors and integrations
Online tools often connect quietly in the background: email marketing platforms, appointment schedulers, payment tools, chat widgets, analytics, automation platforms, and CRM systems. Each integration can create another access path or data-sharing decision.
You do not need to eliminate useful tools. You do need to know which ones have access, what information they receive, and whether they are still necessary. Remove inactive integrations and revoke access for vendors no longer supporting the business.
Make Recovery a Normal Operating Practice
Even careful businesses can experience a compromised account, lost device, or mistaken payment. The difference between a short interruption and a costly mess is usually preparation.
12. Write a one-page response plan
Keep the plan where leadership can access it if email is unavailable. It should name the person who can make urgent decisions, list key vendors and account contacts, and explain how to communicate with employees and customers if necessary.
For most local businesses, the immediate sequence is straightforward:
- Disconnect a suspected compromised device from the network, but do not erase it before documenting what happened.
- Change passwords and revoke active sessions from a known-clean device, starting with email and administrator accounts.
- Contact the affected bank, payment provider, software vendor, or insurer quickly when money or sensitive data may be involved.
- Document the timeline, accounts affected, actions taken, and any messages received for follow-up and recovery.
Run through this plan once a year with the people who would actually handle it. A 20-minute conversation often exposes missing contacts, unclear responsibilities, or recovery codes nobody can find.
Set a Schedule You Can Sustain
Cybersecurity fails when it becomes a project that is finished once and forgotten. Build it into ordinary operations. Review critical access and backups quarterly. Review website updates and forms monthly or through an established maintenance process. Revisit employee training when payment procedures change, a new system is introduced, or a suspicious message reaches the team.
If your website, email, forms, and internal tools have grown without a clear owner, an outside operational review can help identify the priority fixes without creating unnecessary complexity. Erie Digital Co. approaches this work as part of cleaner digital operations: understand the system first, then improve the points where access, data, and day-to-day work intersect.
The useful standard is not whether your business has every security product available. It is whether a reasonable person can see who has access, how critical systems are maintained, how money-moving requests are verified, and what your team will do when something does not look right.