Here's what we see in the field: the businesses that get hit by ransomware or lose money to a phishing email are almost never unlucky. They're missing the basics. Attackers go after small businesses precisely because they expect weak passwords, no backups, and no one watching. Close those gaps and you stop being an easy target.
1. Backups that are actually tested
A backup you've never restored from is a hope, not a plan. Every business needs automated, encrypted backups of its critical data — stored somewhere separate from the machines being backed up, so ransomware can't encrypt both at once. Just as important: someone has to test restoring those files on a schedule. When we manage backups for clients, we run restore tests regularly, because the worst time to discover a broken backup is the day you need it.
2. Multi-factor authentication on every account
Passwords get stolen — through phishing, data breaches, and plain guessing. Multi-factor authentication (MFA) means a stolen password alone isn't enough to get in. Turning it on for email, banking, and business apps is the single highest-impact security step a small business can take, and on Microsoft 365 it costs nothing extra.
3. Endpoint protection on every device
Free antivirus from a decade ago won't stop modern ransomware. Today's endpoint detection and response (EDR) tools watch for suspicious behavior — a program suddenly encrypting thousands of files, for example — and shut it down before it spreads. Every laptop and desktop that touches your business data needs one.
4. Security updates applied promptly
Most major attacks exploit vulnerabilities that already have a fix available — the victim simply never installed it. Windows updates, browser updates, and firmware updates on routers and servers all matter. If your team keeps clicking "remind me later," that's a process problem worth fixing with managed patching.
5. A team that can spot phishing
The most common way attackers get in isn't technical at all — it's an email that looks like a supplier's invoice, a GCash notification, or a message from "the boss" asking for an urgent payment. Short, regular awareness training teaches your team to pause, verify, and report instead of clicking. It costs little and prevents the most expensive incidents.
6. A secured network and Wi-Fi
A router still using its factory password, or a single Wi-Fi network shared by your CCTV, your guests, and your accounting computers, is an open door. Business networks need a properly configured firewall, strong unique admin credentials, and separate networks for guests and devices that don't need access to your files.
7. A plan for when something goes wrong
Even well-protected businesses can get hit. The difference between a bad day and a business-ending event is knowing what to do: who to call, what to disconnect, how to communicate with customers, and how to restore from backup. Businesses that handle personal data also have obligations under the Data Privacy Act — a response plan is part of meeting them.
None of these seven requires an enterprise budget. What they require is someone who sets them up properly and keeps watching them — which is exactly what a managed IT partner does.
Want to know how your business scores on this checklist? Our free IT assessment walks through each of these areas and tells you where your gaps are — no obligation.