Key Takeaways
- Turn on multi-factor authentication for email and admin accounts first. It blocks most account takeovers.
- Keep a list of every laptop, server and cloud app. You cannot protect what you cannot see.
- Test a restore from backup at least once per quarter. An untested backup is a guess.
- Train staff on fake invoices and wire requests. Most losses start with one convincing email.
- Write down who to call and what to do in the first hour of an incident.
Most security advice is written for large companies with a full IT department. If you run a 15-person architecture studio in Little Italy or a 60-person distributor near Kearny Mesa, you need a shorter list. You need the steps that matter most, in an order you can actually follow.
This checklist covers accounts, devices, email, backups, your network, your people and your plan for when something goes wrong. Each item is something you can verify with a yes or no. If you want help doing the work, a team offering cyber security services can take most of it off your plate.
You do not need to finish everything this month. Start at the top. Anything you cannot check off becomes your to-do list, and the 90-day plan near the end shows how to spread it out.
Start With Accounts & Passwords
Stolen logins are the most common way into a business. An attacker does not need to break anything if they can sign in as you. Fixing accounts costs little and pays off fast.
- Turn on multi-factor authentication. Require it on email, remote access, banking and every admin account. Use an authenticator app instead of text messages where you can.
- Use a password manager. Staff should not reuse passwords or keep them in a spreadsheet or on sticky notes.
- Remove old accounts. Disable logins for former employees and contractors on their last day, not weeks later.
- Limit admin rights. Most people do not need to install software or change settings. Give admin access only to those who do.
Check this list against your real user count. Offices with seasonal staff, interns or shared front-desk logins often find accounts nobody remembers creating.
Multi-factor authentication adds a second check, so a stolen password alone no longer opens the account.
Know Every Device & App You Own
A written inventory sounds dull, but it is the base of everything else. When a vendor announces a serious flaw, you need to know within minutes whether you run that product.
- List every laptop, desktop, server, phone, printer and network device.
- Record who uses each one and where it lives.
- List the cloud apps staff use, including ones people signed up for on their own.
- Mark anything that no longer receives vendor updates and plan to replace it.
Shadow apps are the surprise in most reviews. A sales team may store client lists in a free tool no one approved. Finding these early is far cheaper than finding them after a leak.
A simple inventory with owner, location and update status for each device is enough to start.
Lock Down Devices & Updates
Attackers scan for known flaws that already have a fix. Updates close those doors, but only if they actually get installed. The table below shows a realistic schedule.
| Item | Target | Why it matters |
|---|---|---|
| Windows & Mac updates | Within 2 weeks of release | Fixes known flaws attackers scan for |
| Browser & office apps | Automatic | Browsers are a daily entry point |
| Firewall & router firmware | Quarterly | Often forgotten for years |
| Antivirus or endpoint tool | Always on, monitored | Catches threats on each device |
| Disk encryption | On for every laptop | A lost laptop stays unreadable |
Laptops that travel need extra care. A sales rep working from a coffee shop in the Gaslamp or an airport lounge is on networks you do not control. Encryption and a screen lock turn a lost bag into an inconvenience instead of a breach.
Protect Email First
Email is where most attacks begin. Fake invoices, fake vendor bank changes and fake messages from the boss all arrive in the same inbox your staff use all day.
Technical Settings to Check
- Spam and phishing filtering beyond the default.
- Warning banners on messages from outside your company.
- Rules that flag auto-forwarding to outside addresses.
- Domain settings that make it harder to spoof your name.
Process Rules to Set
Technology only goes so far. Set one firm rule: any request to change bank details or send a wire gets confirmed by phone, using a number you already have on file. Wealth managers and accounting teams near UTC should treat this as non-negotiable. A two-minute call stops losses that can reach tens of thousands of dollars.
A clear external-sender banner gives staff a moment to pause before they click.
Back Up Data & Test the Restore
Backups are your last line of defense against ransomware, hardware failure and honest mistakes. They only help if they are recent, separate from your main network and proven to restore.
- Keep three copies. Your live data, one local backup and one copy offsite or in the cloud.
- Isolate one copy. Ransomware hunts for connected backups. At least one copy should be out of its reach.
- Back up cloud email and files too. Having data in Microsoft 365 does not mean it is protected from deletion or attack.
- Restore a sample every quarter. Pick a few files and one full system. Write down how long it took.
Ask a hard question: if your server vanished tonight, how many hours until staff could work again? If you do not know, that is the gap to fix.
Secure the Network & Wi-Fi
Your network is the road everything travels on. Many small offices run on the router their internet provider handed them, with default settings and a shared Wi-Fi password.
- Use a business-grade firewall with current updates and logging.
- Separate guest Wi-Fi from staff Wi-Fi.
- Change every default password on routers, cameras and printers.
- Require a VPN or secure gateway for remote access.
- Turn off services and ports you do not use.
Shared buildings add a wrinkle. In Downtown towers or Mission Valley office parks, neighbors may sit on adjacent networks and building Wi-Fi. Your own firewall and a private network keep your traffic yours.
A managed firewall with logging gives you a record of what crossed the network if something goes wrong.
Train Your People
People are not the weak link, but they are the target. Short, regular training works better than a yearly lecture that everyone forgets.
| Training topic | How often | Format |
|---|---|---|
| Spotting phishing | Monthly | Short simulated email with feedback |
| Wire & payment rules | At hiring, then yearly | Five-minute walkthrough |
| Safe use of personal devices | At hiring | One-page policy |
| Reporting something odd | Always | One email address or phone number |
Make reporting easy and blame-free. A receptionist who reports a strange link in 30 seconds saves you far more than the one who stays quiet from embarrassment.
Test Your Defenses & Plan Your Response
Once the basics are in place, check that they work. A vulnerability assessment scans your systems for known weaknesses and gives you a ranked list. For deeper proof, a penetration test has a skilled tester try to break in the way an attacker would. Budget matters here, so see what a pen test costs in San Diego before you ask for quotes.
Then write an incident plan. It can fit on two pages: who makes decisions, who calls your IT provider, who calls your insurer and lawyer, and how staff communicate if email is down. Print it. You will not be able to open it from a locked system.
If you handle health, client financial or defense-related data, add the rules that apply to your field. A cybersecurity consulting engagement can map those requirements to your daily work and tell you what to fix first.
A Simple 90-Day Plan
Trying to fix everything at once leads to fixing nothing. Spread the work across three months and assign one owner per item.
| Timeframe | Focus | Done when |
|---|---|---|
| Days 1 to 30 | Accounts, MFA, inventory, email settings | Every user has MFA and the device list exists |
| Days 31 to 60 | Updates, encryption, backups, network cleanup | A test restore succeeds and guest Wi-Fi is separate |
| Days 61 to 90 | Training, incident plan, vulnerability scan | Staff trained and the plan is printed |
Many offices decide the monitoring and upkeep are better handled by specialists. Managed security services cover the daily watching and patching, and you can compare the numbers in what managed security costs in San Diego.
A checklist is only useful if someone owns it. Pick a person, set a date for the first 30-day items and put a quarterly review on the calendar. Small, steady progress beats a big plan that never starts. Most offices find that two or three open items account for most of their real risk.
If you would like a second set of eyes, ask for a free IT assessment. You will get a plain list of what is in place, what is missing and what each fix would cost, in writing. There is no pressure to act, and the list is yours to keep either way.
FAQs
How often should we review this checklist?
Review it every quarter and after any major change, such as a new office, a new software system or a wave of hiring. Accounts, backups and updates drift quickly. A short quarterly review keeps small gaps from growing into real exposure.
What is the single most important item?
Multi-factor authentication on email and admin accounts. Stolen passwords are the most common way in, and a second check stops most of those attempts. It costs little, takes an afternoon to roll out and protects everything else.
Do small businesses in San Diego really get attacked?
Yes. Attackers use automated tools that scan thousands of companies and do not care about size. Smaller offices are often easier targets because they have fewer controls. Medical groups, law firms, tech teams and distributors all get hit regularly.
How much does it cost to put this checklist into practice?
Many items are free or low cost, such as MFA, a password manager and training habits. Costs rise with firewalls, endpoint tools and monitoring. Most small offices spend a modest monthly amount per user, and a written quote shows exact numbers.
Can we do this ourselves without an IT company?
Some of it, yes. Accounts, passwords and staff rules are within reach for most owners. Patching, monitoring, backups and network setup take steady attention. If nobody has time to own those tasks, outside help is more reliable than good intentions.
Tyler Navarro
Editorial Director, Giga San Diego
Tyler runs the Giga San Diego editorial desk and turns what our technicians see every week, from Santa Ana wind outages to office moves along I-5, into practical guides for San Diego business owners. He grew up in the county and has spent more than 15 years in IT services, starting on a help desk in Kearny Mesa and later leading network and support projects for biotech firms, clinics, logistics companies and defense suppliers. He holds Microsoft 365 and CompTIA Security+ certifications. Lately he focuses on how AI tools such as Microsoft Copilot can help small teams without exposing sensitive data, and every guide he writes is reviewed by a working technician before it goes live.