An account security checklist for teams of 2 to 20
This account security checklist gathers what the official guides of the UK, Australia, Canada, and the US ask small businesses to do, in 15 steps you can assign and date. Its core: one account per person, multifactor authentication everywhere, phishing-resistant sign-in for administrators, separate admin accounts, regular access reviews, and access removed when someone leaves.
A small business cyber security checklist for your accounts
Work through these 15 steps with the person who owns security in your team, and write a name and a date next to each. They apply the rules of securing a small team’s accounts and come from the free guidance of four governments; the US version closest to this list is the NIST quick-start guide for small businesses to its Cybersecurity Framework 2.0.
Each step names the agencies that recommend it: the NCSC in the UK, the Australian Signals Directorate (ASD), the Canadian Centre for Cyber Security (Cyber Centre), and, in the US, CISA, NIST, and the FTC. The list is our synthesis, not an official one, and no agency publishes this exact order.
The 15 steps
| # | Step | Recommended by | Owner and date |
|---|---|---|---|
| 1 | Name one person responsible for account security, and tell the team who it is | Cyber Centre, Get Cyber Safe | |
| 2 | List every business account (email, bank, payroll, cloud storage, website and domain, social media, point of sale) and who can use it | NCSC, ASD, CISA | |
| 3 | Secure email first: passkeys where offered, otherwise a strong password plus two-step verification | NCSC, ASD | |
| 4 | Turn on multifactor authentication (MFA) on every account that offers it, starting with email, banking, cloud storage, accounting, and social media | ASD, NIST, NCSC | |
| 5 | Require phishing-resistant MFA, such as passkeys or security keys, for administrators and sensitive accounts | NIST, CISA, ASD | |
| 6 | Give everyone a password manager, with long, unique passwords and MFA on the manager itself | NCSC, ASD, NIST, Cyber Centre | |
| 7 | Create one account per person; list the shared accounts that remain and who uses them | ASD, Cyber Centre, NCSC | |
| 8 | Keep administrator accounts separate, with no email or browsing, and use a standard account for daily work | NCSC, Cyber Centre, ASD | |
| 9 | Review who has access to what every few months, and give each person only the access they need | NCSC, ASD, Cyber Centre, CISA | |
| 10 | When someone leaves or changes role, disable their accounts, remove their rights, and change the shared credentials they knew | NCSC, ASD, Cyber Centre, CISA | |
| 11 | Turn on automatic updates, apply critical fixes within 14 days, and replace unsupported software and devices | NCSC, CISA | |
| 12 | Back up automatically, and test that you can restore | ASD, CISA, NIST | |
| 13 | Train everyone when they join and regularly after that: phishing, passwords, and how to report | FTC, ASD, Cyber Centre | |
| 14 | Verify any payment request or change of bank details through a channel you already trust | ASD | |
| 15 | Write an incident plan (who to call, where to report, a copy kept offline) and rehearse it at least once a year | CISA, ASD, NCSC |
The 14-day deadline in step 11 comes from Cyber Essentials, which applies it to updates rated critical or high risk.
If you only have one afternoon
Start where the ASD starts. Its small business handbook, published on October 7, 2026, recommends three measures before anything else: turn on MFA, keep software up to date, and back up data regularly. In checklist terms, that is steps 3, 4, 11, and 12. NIST’s guide adds a starting list for MFA: banking, accounting and tax, merchant accounts, and your Google, Microsoft, or Apple accounts.
Which MFA for whom
- Everyone: any second factor is better than none, as the NCSC puts it. The ASD calls a code by text message or email the least secure option, so prefer an authenticator app or a passkey when the service offers one.
- Administrators and sensitive accounts: NIST says organizations should enforce, or at least offer, phishing-resistant authentication there. CISA notes that FIDO/WebAuthn, the standard behind passkeys and security keys, is the only widely available phishing-resistant method; Cyber Essentials counts FIDO2 passkeys as MFA.
- Cloud services in the UK: if you aim for Cyber Essentials, its version 3.3 requirements say authentication to cloud services must always use MFA.
Passwords: the guides disagree on length
Where a password remains, the official minimums differ:
| Guide | Minimum length |
|---|---|
| ASD small business handbook (Australia) | 15 characters without MFA; with MFA, as long as possible and at least six |
| Cyber Essentials v3.3 (UK) | 12 characters without MFA, or eight with a blocklist of common passwords; eight with MFA |
| FTC (US) | 12 characters, a passphrase is fine |
| Get Cyber Safe (Canada) | 12 characters, a passphrase preferred |
Our recommendation, which satisfies all four: a passkey where the service supports one, otherwise a password of 15 characters or more generated by the team’s password manager. Two of the guides also agree on what not to do: Cyber Essentials and Canada’s baseline controls advise against forcing regular password changes, and keep changes for a suspected compromise.
Where these steps come from
Each country’s guide has its own scope, price, and certification. Our comparison of Cyber Essentials, the Essential Eight, and their counterparts explains which one fits your business.
Step 10, in detail
Departures are where small teams most often leave doors open. See the accounts and codes to recover when someone leaves.
Step 13, for free
You do not need a budget to train a team of five. Our list of free training courses for staff starts with a 30-minute module.