A No-Nonsense Cybersecurity Checklist for Growing Companies

Most breaches at small and mid-sized companies do not come from sophisticated, movie-style hacking. They come from boring, preventable gaps: a reused password, an unpatched server, a permission nobody remembered to remove. The good news is that fixing the boring stuff first removes most of the real risk.

Here is the checklist we work through with clients, ordered by impact rather than by how impressive it sounds.

1. Lock down identity first

• Turn on multi-factor authentication everywhere it is offered, starting with email and admin accounts.
• Use a password manager so people stop reusing the same five passwords.
• Remove access the moment someone leaves or changes roles.

Identity is where the overwhelming majority of intrusions begin, so this is the highest-return work you can do.

2. Patch and update on a schedule

Attackers scan the internet for known, already-fixed vulnerabilities. Keeping operating systems, libraries, and dependencies current closes those doors automatically. Make updates a routine, not a fire drill.

3. Back up like you will need it

Backups are your insurance against ransomware and honest mistakes alike. Keep them automated, keep at least one copy offline or isolated, and, most importantly, test that you can actually restore from them.

4. Test the way an attacker would

Once the basics are in place, a penetration test finds the gaps a checklist misses. This is hands-on probing of your applications and infrastructure that mimics real attacker behaviour, not a box-ticking automated scan. The output should be a ranked list of fixes, highest impact first.

5. Prove it when customers ask

As you sell to larger customers, they will ask how you protect their data. Frameworks like SOC 2 and GDPR give you a structured way to answer with evidence rather than promises. Treat compliance as the byproduct of doing the work above, not as a separate paperwork exercise.

Conclusion

Security is a posture, not a product. Get identity, patching, and backups right, test your assumptions with a real penetration test, and keep evidence as you go. That sequence removes most of the risk for a fraction of what a breach would cost.