Cybersecurity Checklist for Las Vegas Small Businesses
You don't need a six-figure security budget. You need to do the basics consistently.
Most cyberattacks against small businesses succeed not because of sophisticated hacking, but because of missing fundamentals: no multi-factor authentication, outdated software, employees clicking phishing links, or backups that haven't been tested in months.
This checklist covers 15 actions ranked by impact. Start at the top. Every item you complete significantly reduces your risk.
Tier 1: The Non-Negotiables
These five items stop the vast majority of attacks against small businesses. If you do nothing else, do these.
1. Enable Multi-Factor Authentication (MFA) Everywhere
MFA blocks over 99% of automated account attacks. Enable it on:
- Microsoft 365 / Google Workspace (email is the #1 target)
- Banking and financial accounts
- Any application with client data
- Remote access tools (VPN, RDP)
Action item: Log into your Microsoft 365 admin center today and enable security defaults. This turns on MFA for all users at no additional cost.
2. Deploy Endpoint Protection on Every Device
Traditional antivirus isn't enough. Modern endpoint protection (EDR) detects ransomware, fileless malware, and zero-day threats that antivirus misses.
- Install on every computer and laptop (Windows and Mac)
- Include mobile devices that access company data
- Ensure it's centrally managed so you can verify it's running
- SentinelOne, CrowdStrike, and Microsoft Defender for Business are solid options
Action item: Verify endpoint protection is installed and current on every device in your organization. Check the management console-don't just ask employees if they have it.
3. Keep Software Updated
Unpatched software is the second most common attack vector after phishing. Automate updates where possible.
- Enable automatic Windows/macOS updates
- Keep Microsoft 365 apps on the Current Channel
- Update browsers automatically
- Patch third-party software (Adobe, Zoom, etc.) monthly
Action item: Enable automatic updates on all company devices. For applications that can't auto-update, schedule monthly manual updates.
4. Implement Email Security
Email is how most attacks reach your employees. Layer your defenses:
- Enable built-in Microsoft 365 email filtering (Exchange Online Protection)
- Consider an additional email security layer (Proofpoint, Mimecast) for high-risk industries
- Block auto-forwarding rules to external addresses
- Enable Safe Links and Safe Attachments if on Microsoft 365 Business Premium
Action item: Check your Microsoft 365 security settings. At minimum, verify that Exchange Online Protection is active and properly configured.
5. Test Your Backups
Backups that haven't been tested are not backups-they're assumptions. Verify regularly:
- Confirm backup jobs complete successfully (check daily)
- Perform a test restore quarterly
- Ensure backups are stored offsite or in the cloud
- Verify backups cover all critical data (not just some folders)
- Keep at least one backup copy offline or immutable (ransomware-proof)
Action item: Right now, check your backup reports from the last 7 days. If you can't find them or they show errors, this is your top priority.
Tier 2: Strong Foundation
Once the non-negotiables are in place, these items build a solid security posture.
6. Security Awareness Training
Your employees are your last line of defense. Train them to:
- Recognize phishing emails (check sender address, hover over links)
- Report suspicious messages instead of ignoring them
- Use strong, unique passwords (or a password manager)
- Verify unusual requests through a second channel (someone emails asking for a wire transfer-call them to confirm)
Run phishing simulations quarterly. The point isn't to catch people-it's to build the habit of pausing before clicking.
7. Principle of Least Privilege
Every user should have the minimum access needed for their job. No more.
- Don't give everyone admin access to everything
- Review user permissions quarterly
- Remove access immediately when someone changes roles or leaves
- Use separate admin accounts for IT tasks (don't browse the web with an admin account)
8. Secure Your WiFi
- Use WPA3 encryption (or WPA2 at minimum)
- Create a separate guest network for visitors
- Change the default router admin password
- Hide your business SSID if it doesn't need to be visible
- Use a managed firewall for network-level protection
9. Encrypt Sensitive Data
- Enable BitLocker (Windows) or FileVault (Mac) on all laptops
- Use encrypted email for sensitive communications
- Ensure cloud storage (OneDrive, SharePoint) encryption is active
- Encrypt mobile devices
10. Incident Response Plan
Know what to do before something happens:
- Who do you call first? (IT provider, then legal, then insurance)
- How do you isolate an affected system?
- Where are your backup recovery procedures?
- Who communicates with affected clients?
- Do you have cyber insurance? What does it cover?
Write this down. Share it with your team. Keep a printed copy accessible.
Tier 3: Advanced Protection
These items are important for businesses in regulated industries (healthcare, legal, financial) or those handling particularly sensitive data.
11. 24/7 Security Monitoring (SOC)
A Security Operations Center monitors your systems around the clock for suspicious activity. Alerts are investigated by security analysts who can respond to threats in real time.
This is the difference between detecting an attack at 2 AM versus discovering it Monday morning.
12. Conditional Access Policies
Control who can access what, from where:
- Block logins from countries where you don't do business
- Require MFA for risky sign-ins (new device, unusual location)
- Require compliant devices for access to sensitive data
- Block legacy authentication protocols
13. Data Loss Prevention (DLP)
Prevent sensitive data from leaving your organization:
- Block sharing of files containing SSNs, credit cards, or health records
- Monitor email attachments for sensitive content
- Control USB drive usage on company devices
14. Vulnerability Scanning
Scan your network and devices regularly for known vulnerabilities:
- Run automated vulnerability scans monthly
- Prioritize and remediate critical findings within 48 hours
- Scan after any significant network changes
15. Compliance Documentation
If your industry has specific requirements (HIPAA, PCI DSS, SOC 2), maintain:
- Written security policies
- Risk assessments (annual)
- Evidence of security controls
- Incident response procedures
- Employee training records
Where to Start
If you're starting from zero, focus on Tier 1 this week. Those five items alone will dramatically reduce your risk.
If you're already doing the basics and want to level up, or if you're in a regulated industry that requires compliance documentation, contact us for a security assessment. We'll identify your gaps and build a plan to close them.
View our cybersecurity plans or call (702) 509-9005.