Key Takeaways
- Turn on multi-factor authentication for email, banking and remote access before anything else.
- Keep one backup copy offline or unchangeable, and test a restore at least twice a year.
- Patch laptops, servers and your firewall on a fixed schedule, not whenever someone remembers.
- Train staff on fake invoices and wire requests, since those scams hit Chicago offices every week.
- Write down who you call first when something goes wrong, and keep that page printed.
Most security problems at small Chicago businesses are not exotic. A stolen password. An unpatched laptop. A fake invoice that looked real at 4:45 on a Friday. The fixes are known, and most of them cost very little. What goes wrong is that nobody owns the list, so items slip for months.
This checklist is built to be used, not admired. Each section covers one area, shows what “done” looks like and tells you what to ask your team or provider. If you want help beyond the list, cybersecurity solutions for Chicago businesses covers the tools and monitoring that keep these checks from lapsing.
You do not need to finish everything this week. Start with accounts and email, then backups, then work down the page. Print it, mark what is true today and be honest about the rest. A list with gaps you know about is far more useful than one you assume is complete.
How to Use This Checklist
Give every item one of three marks: done, partly done or not done. “Partly” counts as not done until you can name exactly what is missing. Many owners find that “we have antivirus” really means “it was installed on some computers three years ago.”
Pick one person to own the list. That can be you, an office manager or your IT provider, but it must be a named person with a date to review it. Security checks that belong to everyone get done by no one.
- Review the full list every quarter.
- Recheck accounts and devices whenever someone joins or leaves.
- Rerun the backup and email sections after any change of provider or software.
- Keep your marked-up copy so you can show progress over time.
Accounts & Passwords
Stolen credentials are the most common way into a small business. Attackers buy leaked passwords by the thousands and try them against Microsoft 365, banking portals and remote access tools. Your goal is to make a stolen password useless on its own.
- Multi-factor authentication everywhere that matters. Start with email, banking, payroll, remote access and admin accounts. App-based codes beat text messages.
- A password manager for every employee. Unique passwords for every site, with no sticky notes under keyboards.
- No shared logins. Each person gets their own account so you can see who did what and remove access cleanly.
- Admin rights only for admins. Daily work should happen on standard accounts. Owners often forget this one about themselves.
- A same-day offboarding routine. When someone leaves, their email, VPN, cloud apps and phone access are shut off that day.
A quarterly account review often turns up former employees who still have working logins.
Email & Phishing Defenses
Email is still the front door. Fake invoices, shared-document links that lead to a copied login page and “urgent” messages that appear to come from the owner all land in Chicago inboxes daily. Filtering helps, but people make the final call.
- Spam and phishing filtering is on and set to quarantine, not just flag.
- External senders are labeled so staff can see when a message did not come from inside.
- Rules that quietly forward mail to outside addresses are blocked and audited.
- Your domain has SPF, DKIM and DMARC set up so no one can easily send mail pretending to be you.
- Anyone who handles payments follows a call-back rule for any change to bank details.
The Call-Back Rule
If a vendor, tenant or client emails new bank details, call them on a number you already had on file. Never use the number in the email. This single habit stops a large share of payment fraud, and it costs nothing.
A mismatched sender domain, such as one extra letter in a vendor name, is among the most common tells.
Devices, Updates & Endpoint Protection
Every laptop, desktop and phone that touches company data is a possible entry point. The risk grows with remote work, home Wi-Fi and the habit of working from a train or coffee shop on the way into the Loop.
| Check | What “Done” Looks Like | How Often |
|---|---|---|
| Operating system updates | Applied automatically, with a report of any machine that is behind | Monthly at minimum |
| Third-party app updates | Browsers, PDF readers and office software kept current | Monthly |
| Endpoint protection | Modern antivirus with alerting, installed on every device | Always on |
| Disk encryption | BitLocker or FileVault turned on for laptops | Once, then verified |
| Device inventory | A current list of every computer and phone with its owner | Quarterly |
| Lost device plan | Ability to lock or wipe a device remotely | Tested once a year |
A lost, unencrypted laptop is a reportable problem in many industries. An encrypted one is usually just a replacement cost.
A device that has missed updates for 60 days is far easier to attack than one patched on schedule.
Network, Wi-Fi & Remote Access
Your network is the shared hallway for everything else. The basics are not glamorous, but they matter: a business-grade firewall, separate guest Wi-Fi and no open doors to the internet that nobody remembers opening.
- The firewall is a business model with current firmware, not the router the internet provider left behind.
- Guest Wi-Fi is on a separate network from staff devices and printers.
- Remote access uses a VPN or similar secure method with multi-factor authentication, never an exposed remote desktop port.
- Default passwords on routers, cameras and printers have been changed.
- Wi-Fi uses WPA2 or WPA3 with a strong passphrase that is changed when staff leave.
- Someone reviews firewall rules at least once a year and removes old ones.
If you share a building riser with other tenants, as many Loop and River North offices do, ask property management which equipment is yours and which is the building’s. Your responsibility starts at your own firewall.
Backups & Recovery
Backups are the check that decides whether a bad day is an annoyance or a business-ending event. The test is simple: if every computer in the office were wiped tonight, how long until you were working again, and what would you lose?
| Question | Weak Answer | Strong Answer |
|---|---|---|
| Where is the backup? | On a drive plugged into the server | Off-site copy plus one that cannot be changed or deleted |
| How often? | “Sometimes” | Daily, with alerts when a job fails |
| Has a restore been tested? | Never | At least twice a year, with notes |
| Is Microsoft 365 covered? | Assumed to be backed up by Microsoft | Separate backup of mail, files and Teams data |
| How long to recover? | No idea | A written target, such as one business day |
Ransomware crews look for backups first and delete them. That is why one copy must sit somewhere your normal accounts cannot reach.
A restore test takes under an hour and tells you more than a year of green checkmarks.
People, Policies & Training
Technology covers the machines. Habits cover everything else. You do not need a thick policy binder. You need a few short rules that people actually know.
- Short acceptable-use rules. One page on what company devices and accounts may be used for, signed by every new hire.
- Security training twice a year. Fifteen minutes of real examples beats an annual video nobody watches.
- Phishing tests with no blame. Send fake messages, show who clicked and teach, never punish.
- A clear way to report mistakes. Staff should feel safe saying “I think I clicked something” within minutes, not days.
- Vendor access rules. Outside contractors get limited, time-boxed access and nothing permanent.
Owners sometimes assume only large firms are targeted. In practice, attackers favor small offices precisely because the defenses are thinner and the payment approval chain is short.
Testing, Monitoring & Outside Help
A checklist tells you what should be true. Testing tells you what is true. Once the basics are in place, add an outside look. A vulnerability assessment scans your systems for known weaknesses and gives you a ranked fix list. A penetration test goes further and tries to break in the way an attacker would.
Most small offices do not need both every year. If you are deciding where to spend, penetration testing pricing in Chicago explains typical ranges, and small business cybersecurity cost in Chicago covers the wider budget picture.
Who Watches the Alerts?
Tools that send alerts to an inbox nobody reads protect no one. Decide who watches, how fast they respond and what happens after hours. Some offices handle this with a managed security services provider. Others bring in cybersecurity consulting to set a plan, then run it themselves.
If Something Goes Wrong
The worst time to decide who to call is during an attack. Write a one-page response sheet now and keep a printed copy in the office, since your files may be unavailable when you need it.
- Names and mobile numbers for the owner, office manager and IT contact.
- The number for your IT provider or security partner, and your cyber insurance claims line if you have a policy.
- Your attorney’s contact, in case client or patient data may be involved.
- Where backups live and who can start a restore.
- A rule to disconnect affected computers from the network first and shut nothing down until advised.
Do not pay anyone, wipe machines or delete logs before you have spoken to someone qualified. Early moves can destroy evidence and limit recovery options.
A good checklist does not make you secure by itself, but it does show you where you stand. Most Chicago offices find that a handful of items cause most of the risk: accounts without multi-factor authentication, devices behind on updates and backups that were never tested. Those are fixable in weeks, not years.
Take the list, mark honestly what is done and what is not, and start with the top three gaps. If you would rather not do it alone, book a free IT assessment. You get a written summary of what is working, what is exposed and what it would cost to close the gaps, with no pressure to sign anything.
FAQs
How often should a Chicago business review its cybersecurity checklist?
Review it every quarter, and again whenever staff change, you switch software or you move offices. Quarterly works because patches, accounts and backups drift quietly. A short, scheduled review keeps small problems from growing into expensive ones.
What is the first thing a small business should do for cybersecurity?
Turn on multi-factor authentication for email, banking and remote access. Stolen passwords are the most common way in, and this step blocks most of those attempts. It takes an afternoon and usually costs little or nothing.
Do small Chicago offices really get targeted?
Yes. Attackers use automated tools that scan everywhere, and small offices tend to have weaker defenses and faster payment approvals. Size does not protect you. Common attacks include fake invoices, stolen logins and ransomware aimed at accounting and client files.
Is antivirus enough protection?
No. Antivirus is one layer. You also need updates, multi-factor authentication, email filtering, tested backups and trained staff. Modern endpoint protection with alerting is better than old signature-only antivirus, but it still cannot replace the rest of the list.
How do I know if my backups would actually work?
Run a test restore. Pick a folder or a full machine and recover it, then note how long it took. If no one has tested a restore in the last six months, treat your backups as unproven until you do.
Should I pay for a penetration test or a vulnerability scan first?
Most small offices start with a vulnerability assessment, since it is cheaper and finds common weaknesses quickly. A penetration test makes more sense once the basics are fixed or when a client or insurer asks for one.
Reid Callahan
Editorial Director, Ping Chicago
Reid leads the Ping Chicago editorial team and works with our technicians to turn real support tickets, office moves and security reviews into plain-English guides for Chicago business owners. Born and raised in Chicago, he has spent more than 15 years in IT services, starting on the help desk and later running support and network projects for law firms, medical practices and manufacturers from the Loop to the western suburbs. He holds Microsoft 365 and CompTIA Security+ certifications and has helped hundreds of local offices move to the cloud. Today he focuses on how AI tools like Microsoft Copilot can save small teams time without putting company data at risk, and every guide he writes is checked by a working technician before it goes live.