The end of the year is the right moment to tidy up security. People have joined and left, contractors have come and gone, and the systems set up in a hurry back in spring are still running on their first settings. December also brings a wave of fake invoices, delivery notices and urgent payment requests, timed for when everyone is busy and trying to close the books.
None of the fixes below needs a security department. They follow the basics recommended by the U.S. Cybersecurity and Infrastructure Security Agency in its Secure Our World campaign and the Federal Trade Commission’s Cybersecurity for Small Business guide. For most small teams, the whole list is an afternoon’s work.
1. Turn on multi-factor authentication, starting with email
Email comes first because every other password can be reset through it. Once email is covered, turn on multi-factor authentication (a code from an app or a text in addition to the password) for banking, payroll, accounting software, your website’s admin login and your domain registrar. An authenticator app is stronger than a text message where both are offered.
2. Move shared passwords into a password manager
If passwords live in a spreadsheet, a notebook or a group chat, this is the week to change that. A password manager lets each person use a long, unique password for every account and lets you share a login with a colleague without revealing it. Start with the accounts several people use, then change any password that was ever shared in plain text.
3. Remove access for anyone who has left
Make a list of everyone who left this year: employees, contractors, interns and agencies. For each one, check email, shared drives, social media accounts, your website’s user list, accounting software and any tool billed per user. Close or transfer what you find. Then add the same steps to your offboarding routine so it happens on the person’s last day next time. If you do not have that routine written down yet, our guide to writing a standard operating procedure shows how to capture it in one page.
4. Update everything, including the website
Install the pending updates on computers and phones, and restart them so the updates actually apply. Do not forget the office router. On your website, update the platform, plugins and theme, and delete plugins you no longer use: a switched-off plugin still sits on the server. If an update worries you, take a backup first.
5. Test a backup by restoring something
Keep three copies of important data, on two different kinds of storage, with one copy off-site or in the cloud. Then prove it works: restore one file, one folder or a copy of your website. A backup that has never been restored is a hope, not a plan.
6. Brief the team on end-of-year phishing
Five minutes at the next team meeting is enough. Show the patterns that rise in December: an invoice from a supplier you do not use, a “missed delivery” link, a gift card request that appears to come from the owner, or a message asking to change a supplier’s or employee’s bank details. Agree one rule: any request to pay, or to change payment details, is confirmed by phone using a number you already have, never the one in the email.
7. Check who owns your domain and key accounts
Find out whose name and email address sit behind your domain registration, website hosting, Google Business Profile and social media pages. They should be tied to an address the business controls, not a former employee’s or a personal one. Note the renewal dates while you are there; an expired domain takes your email and website down together.
8. Write a one-page “what if” plan
Decide now who to call if an account is taken over, a laptop is stolen or a payment goes to the wrong place. One page is enough: the people to contact, the bank’s fraud line, where the backups are and how to restore them. Keep a printed copy, because the computer may be the thing that is down.
Key takeaways
- Protect email first; it is the master key to every other account.
- Remove former staff and contractors from every system, then make that part of offboarding.
- Updates and tested backups prevent most bad days from becoming bad weeks.
- Confirm every payment change by phone, especially in December.
Want help running the checklist?
Security is part of our IT and digital transformation services. We can walk through the eight checks with you, set up multi-factor authentication and a password manager for your team, and leave you with the one-page plan. Book a consultation and we will start with the accounts that matter most.
