Cybersecurity Checklist for Small Businesses in 2027
If someone asked you right now, “How secure is your business?” could you answer with confidence?
Not whether you have antivirus.
Not whether employees have passwords.
Not whether someone installed a firewall five years ago.
Could you explain what your business is doing today to protect its people, devices, accounts, data, and ability to keep operating?
That is a much harder question.
And as we head into 2027, it is becoming a more important one.
Verizon's 2026 Data Breach Investigations Report found that 31% of breaches started with the exploitation of software vulnerabilities, making it the leading initial access vector in its dataset. Ransomware was involved in 48% of breaches, and generative AI is now augmenting multiple attack techniques.
At the same time, attackers are finding new ways to exploit something businesses have always depended on: trust. Microsoft documented 2026 attacks in which threat actors impersonated IT support through Microsoft Teams and convinced employees to grant remote access using legitimate support tools.
So if your cybersecurity plan begins and ends with antivirus, passwords, and telling employees not to click suspicious emails, 2027 is a good year to take another look.
This cybersecurity checklist for small businesses is designed to help you do exactly that.
A Cybersecurity Checklist Built Around the Business
There is an important reason this checklist goes beyond security software.
The NIST Cybersecurity Framework 2.0 organizes cybersecurity around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Together, they recognize that cybersecurity is not only about keeping attackers out. Businesses also need to understand their risks, detect suspicious activity, know how to respond, and restore operations afterward.
With that bigger picture in mind, here are 12 questions worth asking about your business in 2027.
1. Do You Know Everything Connected to Your Business?
You probably know about the laptops sitting on employees' desks.
But what about the rest?
Think about servers, wireless access points, network switches, firewalls, printers, security cameras, access control systems, conference room equipment, phones, employee mobile devices, cloud applications, remote-access software, and old systems that nobody thinks about anymore.
Every device, application, and service connected to your business adds another piece to the technology environment you need to understand.
NIST's small-business guidance recommends identifying the hardware, software, systems, services, and data an organization relies on as part of understanding cybersecurity risk.
So instead of asking:
“Do we have an inventory?”
Ask:
“If something connected to our business became vulnerable tomorrow, would we know we had it?”
If the answer is no, that is a good place to begin.
2. Are You Patching What Attackers Are Actually Exploiting?
“Keep your software updated” is good advice.
But in 2027, businesses should be asking a more useful question:
Which vulnerabilities need our attention first?
That distinction matters because not every vulnerability presents the same risk.
CISA maintains its Known Exploited Vulnerabilities Catalog to identify vulnerabilities that have evidence of exploitation in the wild and recommends organizations use the catalog as an input when prioritizing vulnerability management.
This is particularly relevant given Verizon's finding that vulnerability exploitation was the leading initial access vector in its 2026 breach dataset.
Your business does not need someone frantically installing every update the moment it appears.
It needs a process for identifying what's vulnerable, understanding what is exposed, prioritizing the greatest risks, and making sure important updates actually get completed.
A better question for whoever manages your technology is:
“How do you decide which vulnerabilities in our environment need to be addressed first?”
3. Is Your MFA Ready for Modern Phishing
If your business has already enabled multifactor authentication, that's a meaningful step.
But don't stop the conversation there.
Not every form of MFA offers the same protection, and authentication itself is changing.
Microsoft announced in July 2026 that it is making passkeys the default authentication experience in Entra ID as it moves organizations toward phishing-resistant authentication and away from Microsoft-provided SMS and voice authentication delivery, which it plans to retire in 2027.
Why does that matter?
Because an employee can still be manipulated into approving an unexpected authentication request or handing information to a convincing fake login page.
So ask:
Are all important accounts protected by MFA?
What type of MFA are we using?
Are administrator and other high-value accounts getting stronger protection?
The goal isn't to chase the newest authentication technology just because it exists. It's to make sure the way your business verifies identities is keeping pace with the ways attackers try to steal them.
4. Who Still Has Access That They No Longer Need?
Think about what happens over the course of a year.
Someone changes departments.
A manager receives additional permissions.
A contractor gets temporary access.
An employee leaves.
A vendor needs access to troubleshoot a system.
Another employee becomes an administrator because it was easier at the time.
The question is what happens afterward.
Do those permissions get changed or removed?
Access tends to accumulate quietly. The longer it goes unchecked, the easier it is for people, accounts, applications, and services to have access they no longer need.
Reviewing permissions should therefore include more than former employees. Look at administrator rights, shared accounts, vendor access, inactive users, cloud applications, and other elevated permissions.
The principle is simple:
People should have the access they need to do their jobs, not every permission they
have ever needed.
5. Are You Protecting the Technology Nobody Thinks of as a Computer?
When people hear “cybersecurity,” they often picture laptops and servers.
A modern office is much more connected than that.
Your network may also include:
Security cameras
Access control systems
Printers and multifunction devices
Business phones
Wireless access points
Conference room technology
Network switches and firewalls
Other connected devices
Those systems may use passwords, store information, run software or firmware, communicate across your network, or connect to cloud services.
That makes them part of the cybersecurity conversation too.
This is where things like changing default credentials, installing firmware updates, limiting unnecessary access, and properly segmenting networks can matter.
It is also why looking at IT, networking, cabling, communications, and physical security as completely separate worlds can create blind spots.
Your network doesn't care which vendor installed the device. If it's connected, it's part of the environment.
6. Are Your Employees Prepared for Phishing That Doesn't Look Like Phishing?
For years, phishing awareness focused heavily on email.
Look for spelling mistakes. Don't open suspicious attachments. Check the sender.
Employees still need those skills.
But attacks are changing.
In September 2026, Microsoft detailed an intrusion campaign in which attackers contacted employees through Microsoft Teams while impersonating IT or helpdesk personnel. The attackers attempted to convince users to grant remote access using legitimate remote-management tools.
Microsoft has also reported growth in Teams-based social engineering and increasingly automated, multi-stage attack chains during 2026.
That means a suspicious interaction could be an email, Teams message, phone call, QR code, authentication request, or someone claiming to be technical support.
Instead of teaching employees only to ask:
“Does this look fake?”
Teach them to ask:
“Was I expecting this?”
Unexpected request from IT?
Unexpected MFA prompt?
Unexpected QR code?
Unexpected request to install remote-support software?
Stop and verify it using a contact method you already trust.
That simple habit can be more useful than trying to memorize every new phishing technique.
7. Do You Know Which AI Tools Have Access to Company Information?
Here's a question that probably wasn't on your cybersecurity checklist a few years ago:
Which AI tools did your employees use today?
Not which tools your business purchased.
Which ones they actually used.
Employees may be using AI to rewrite emails, summarize documents, analyze spreadsheets, brainstorm ideas, prepare proposals, or automate repetitive work.
Now AI agents are adding another layer.
Microsoft warns that AI agents can interact with applications, invoke tools, access information, and perform actions, which makes visibility, identity, ownership, and appropriate permissions increasingly important.
So your 2027 cybersecurity review should include questions such as:
What AI tools are employees using?
What company information are they entering?
What applications are connected to those tools?
Who owns and manages AI agents?
What can those agents access or change?
Do employees understand what is and isn't appropriate to share?
The goal isn't to make AI difficult to use.
It's to make responsible AI use easier to understand.
8. If Your Backup Disappeared With Everything Else, Would You Still Have a Backup?
Ask a business whether it has backups and you'll often hear:
“Yes.”
Now ask:
“When was the last time you successfully restored something from them?”
That's a different conversation.
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity. One reason is that ransomware may attempt to find and encrypt or delete accessible backups along with production data.
Your backup review should therefore go beyond confirming that a backup job says “successful.”
Ask:
What exactly are we backing up?
How frequently?
How is the backup protected?
Could a compromised account delete or alter it?
How quickly could we restore important systems?
What would we restore first?
When did we last perform a successful test restore?
A backup you have never tested is partly a promise.
A successful restore is evidence.
9. How Long Would It Take Someone to Notice an Attacker Was Already Inside?
A lot of cybersecurity conversations focus on preventing someone from getting in.
But what if they already did?
Would anyone notice?
This is where detection becomes just as important as protection.
NIST makes Detect its own function within the Cybersecurity Framework because organizations need the ability to find and analyze possible cybersecurity attacks and compromises.
For a small business, that doesn't mean someone needs to stare at a wall of security dashboards all day.
It does mean someone should know what matters and be paying attention.
Are unusual login attempts monitored?
Would suspicious administrator activity trigger an alert?
Is endpoint behavior being monitored?
Who receives important security alerts?
Who reviews them?
What happens after hours?
One of the most revealing questions you can ask whoever manages your cybersecurity is:
“If someone got into one of our systems tonight, how would we know?”
10. Could One of Your Trusted Vendors Become Someone Else's Way Into Your Business?
Your cybersecurity doesn't stop at your front door.
Think about how many outside organizations your business depends on.
Your IT provider.
Payroll company.
Accountant.
Software vendors.
Cloud providers.
Building or security vendors.
Contractors.
Other companies that store your information or access your systems.
The FTC recommends considering cybersecurity risk from vendors, setting security expectations in contracts, limiting how vendors handle information, and verifying compliance rather than simply taking assurances at face value.
Start by asking:
“Which outside companies can access our systems or sensitive information right now?”
Then determine whether they still need that access and what protections are in place.
You may trust your vendors.
That doesn't mean you should ignore the access they have.
11. Does Everyone Know What to Do in the First 30 Minutes of a Cyber Incident?
Imagine an employee walks into your office tomorrow morning and says:
“I think I clicked something.”
What happens next?
Do they know who to call?
Does your manager?
Does your IT provider know who inside the company has authority to make decisions?
What if the incident involves ransomware?
What if email isn't working?
Who contacts your cyber insurance carrier?
Where are your emergency contact numbers stored?
Who communicates with employees or customers if necessary?
An incident response plan doesn't need to begin as a 100-page binder.
It needs to answer the practical questions people will have when something is actually happening.
Because the middle of a cybersecurity incident is a terrible time to start exchanging phone numbers and deciding who is responsible for what.
12. Could Your Business Operate Without Its Technology Tomorrow?
This may be the most important question on the entire cybersecurity checklist.
Imagine your team arrives tomorrow and your critical systems aren't available.
What happens?
Can you communicate with customers?
Can employees access the files they need?
Can you invoice?
Can you receive payments?
Can you ship products?
Can employees access the building?
Can your phones work?
Which system absolutely needs to come back first?
NIST treats Recover as one of the six core cybersecurity functions because restoring assets and operations after an incident is part of cybersecurity, not something separate from it. CISA similarly recommends prioritizing restoration around critical services when recovering from ransomware.
This is where cybersecurity becomes a business conversation.
The goal isn't simply to keep attackers out.
The goal is to keep your business resilient when something goes wrong.
How Many Boxes Could You Confidently Check?
Go back through the checklist.
Not how many things you think your business probably does.
How many could you confidently explain?
☐ Do we know what's connected to our business?
☐ Are vulnerabilities being prioritized and patched?
☐ Are we using appropriate MFA and stronger authentication where needed?
☐ Are user, administrator, and vendor permissions regularly reviewed?
☐ Are connected devices beyond traditional computers being protected?
☐ Can employees recognize phishing outside of email?
☐ Do we know how employees and AI agents are using company information?
☐ Are our backups protected and regularly tested?
☐ Would we know if someone had compromised an account or device?
☐ Are we reviewing third-party and vendor access?
☐ Does everyone know what to do when an incident happens?
☐ Could we recover the systems our business depends on?
If some of those questions made you stop and think, that's useful.
You just found something worth asking about.
Don't Ask Your IT Provider, “Are We Secure?”
There may be an even better way to use this checklist.
The next time you talk with whoever manages your technology, don't ask:
“Are we secure?”
That's an almost impossible question to answer with a meaningful yes or no.
Instead, ask:
“What are the three biggest cybersecurity risks you see in our business right now?”
“Which systems would be hardest for us to operate without?”
“How quickly would we know if an account or device were compromised?”
“When did we last successfully restore something from backup?”
“Which security improvement would you prioritize next if this were your business?”
Those questions create a much better conversation.
Because good cybersecurity isn't about claiming your business is completely secure.
It's about understanding your risks, deciding what matters most, reducing those risks where you can, and being prepared for what happens if something still goes wrong.
Cybersecurity Shouldn't Be Something You Only Think About After Something Happens
Your business will change throughout 2027.
Employees will come and go.
New devices will connect.
Software will change.
AI tools will become more capable.
Vendors will gain and lose access.
Attackers will adjust their tactics.
Your cybersecurity has to change with it.
At TriTech, we help businesses across Southeastern Wisconsin look at cybersecurity as part of the bigger technology picture, including users, devices, networks, Microsoft 365, backups, infrastructure, and ongoing IT support.
You don't need to become a cybersecurity expert yourself.
But someone should be paying attention.
If this cybersecurity checklist raised a few questions about your own environment, that's a good place to start the conversation.
Comments