Staff Cyber Safety Checklist for Small Business
A simple staff checklist helps everyone know when to stop, check and ask before approving risky emails, login prompts or payment changes.
Quick answer: stop and verify using a trusted contact method before you pay, approve, reply or ignore warning signs.
Quick answer
Pause high-risk actions, verify instructions outside the suspicious message thread, protect important accounts with MFA, and keep a clear record of what happened. Small businesses benefit from simple controls that staff can follow under pressure.
Fast decision
What this means for a small business
A simple staff checklist helps everyone know when to stop, check and ask before approving risky emails, login prompts or payment changes.
Most business cyber problems become expensive when a normal-looking request is handled too quickly. A safer process gives staff permission to pause, check the source, and ask for help before money, access or sensitive information is exposed.
This guide uses fake examples only. It is designed to help you prepare a safer next step, not to collect private records or replace professional investigation.
Warning signs to check
- Staff know who to contact about suspicious email.
- Staff do not approve unexpected login prompts.
- Staff understand changed bank details must be verified.
- New starters and departing staff have clear access steps.
What to do now
- Give staff one clear internal reporting path.
- Add payment-change checks to onboarding and finance procedures.
- Remove access promptly when staff leave.
- Repeat simple reminders instead of relying on one-off training.
What not to do
- Do not blame staff for reporting suspicious activity.
- Do not leave old accounts active because it is convenient.
- Do not rely on memory for supplier payment checks.
Related Business Cyber Safety links
Two-person supplier payment approval
Continue with the related Business Cyber Safety guide.
Business email compromise warning signs
Continue with the related Business Cyber Safety guide.
Scam Safety hub
Use this when the issue looks like a scam message, fake invoice or payment redirection attempt.
Essential Eight small business hub
Review broader basics like two-step login, backups, updates, admin access and safer devices.
Benefits and practical outcomes
Use these outcomes as a practical check on whether the advice is making the situation clearer and easier to manage.
Reduce avoidable exposure
Simple account, update, access and verification controls can reduce common preventable weaknesses.
Recover with less guesswork
Documented owners, backups and evidence make incident response and restoration easier to organise.
Give staff a repeatable check
Plain-English steps are easier to follow than relying on memory when an unusual request arrives.
Prioritise the next fix
A short checklist helps separate urgent controls from improvements that can be scheduled later.
Example: turn the checklist into owned actions
A five-person business lists its important accounts, devices, backups and administrator access. Each gap gets an owner and a next action instead of remaining an informal “we should fix that” task.
Outcome: security work becomes a practical queue of improvements that can be reviewed.
FAQ
Is this a formal cyber audit?
No. This is a practical self-check guide, not a formal audit, investigation, certification or guarantee.
Should I share passwords or login codes?
No. Do not share passwords, login codes, banking passwords, card numbers or private customer records through this guide.
What if money has already been sent?
Contact your bank immediately. Then collect the invoice, email details and verification notes for review.