30-Point Cyber Risk Checklist

Problem

Most small businesses do not fail because they ignored security completely. They fail because nobody has a simple way to see which basic controls are missing, stale, or assumed to be handled by someone else.

Why it matters in 2026

QR phishing, vendor questionnaires, cyber insurance reviews, AI adoption, and Microsoft 365 identity attacks are normal business pressure, not edge cases.

Who this affects

• Owners and operators responsible for risk without a full security team.
• Lean IT teams supporting Microsoft 365 and cloud tools.
• B2B vendors preparing for customer security questions.

Step-by-step recipe

1. Check MFA coverage for every user and administrator.
2. Review email authentication: SPF, DKIM, and DMARC.
3. Confirm backups are separate from daily user accounts.
4. Identify vendors with access to email, files, finance, or customer data.
5. Write down the first 24-hour incident response contacts.
6. List AI tools in use and what data must never be pasted into them.

Common mistakes

• Assuming Microsoft 365 defaults are enough.
• Having backups that share the same compromised identity path.
• Not knowing who can approve vendor access.

Downloads and next steps

DIY next step

Start with MFA, email authentication, and backup ownership. Those three areas usually reveal whether the rest of the baseline is under control.

CyberHouse CTA

Want us to handle this for you? CyberHouse can help with Microsoft 365 protection, cyber risk cleanup, ransomware readiness, secure automation, and vendor-ready cyber baseline work.

Related Recipes