Basic protections every small business can put in place: accounts, devices, backups, staff habits and leavers.
Small businesses are frequent targets because they often lack basic protections. Most attacks start with a stolen password or a fake email.
Shift teams add a specific risk: shared devices and logins at kiosks, registers and tablets. Give each person their own login where possible.
14 items. Fill it in on screen or print a copy.
A 20-person cleaning company turns on multi-factor authentication for email and payroll, moves shared tablet logins to personal PINs, and adds a step to its offboarding checklist to remove access on the last day.
Every US state has a data breach notification law, so a hacked inbox holding employee Social Security numbers or customer card data can trigger notice duties. Payroll account takeovers are also used to redirect direct deposits, which is why the list puts multi-factor authentication on payroll first.
| Password manager | Set up for 9 staff, shared vault for vendor logins |
|---|---|
| Multi-factor | On for email, bank, payroll; POS admin pending |
| Admin rights | Owner and office manager only |
| Updates | Auto-update on; 1 front desk PC was 3 months behind |
| Backups | Nightly cloud plus weekly USB kept off-site |
| Restore test | Client file restored Oct 20, worked |
| Offboarding | Groomer Tess removed from email, schedule, POS same day |
Harbor Paws Grooming runs three shops in Tampa, and Kevin, the owner, marks the POS admin login as pending instead of ticking it. An honest pending item is more useful than a full column of checks.
Multi-factor authentication on email and finance accounts.
For setup and reviews, it often helps.
At least daily for important data.
No. It is a baseline.
Text codes are much better than a password alone, but they can be intercepted if someone talks your phone carrier into moving your number to a new SIM. An authenticator app or a hardware security key is stronger. Use the stronger option first on email, banking and payroll, where a takeover costs the most.
Disconnect that device from the network and change the password for the affected account from a different device. Check whether multi-factor authentication is on and whether any email forwarding rules were added. If payment or bank details may have been exposed, call the bank right away, and thank the employee for reporting so others report too.
More for the same job
Assign the work in EZTime to an employee, a team or a whole location, ask for photo proof, and get a late alert instead of chasing people. Book a demo if you want a walkthrough.