Small Business Cybersecurity Checklist for the Holiday Season

Before the holiday rush, every small business should turn on multifactor authentication for email, banking and payment accounts, train staff to spot phishing and fake payment requests, confirm backups actually restore, update every device and lock down how card payments are taken. This checklist walks through each step in plain language, based on guidance from CISA, the FTC and the FBI, with a printable priority table and a simple plan for what to do if something goes wrong.

Why the Holiday Season Raises Your Risk

The end of the year brings more orders, more shipping notices, more invoices, more temporary staff and more people working from phones and laptops away from the office. Criminals plan around that. A fake “delivery failed” text or an urgent “updated bank details” email is easier to fall for when you’re busy and short-staffed.

The numbers show why this matters. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025 with reported losses of $20.877 billion, up 26% from 2024, according to its 2025 Internet Crime Report. Business email compromise accounted for about $3.05 billion of those losses, second only to investment fraud, and phishing and spoofing generated 72,984 complaints. These figures cover only incidents people reported, so real losses are likely higher.

Common holiday scams aimed at small businesses

• Fake shipping notices by text or email with links to “reschedule delivery.”
• Invoice and payment-change fraud from a spoofed or hacked vendor email asking you to pay a new account.
• Gift card requests that appear to come from the owner or a manager (“Can you buy six $200 gift cards for client gifts? I’m in a meeting”).
• Tech support scams claiming your computer or account has a problem and asking for remote access.
• Fake order and refund scams targeting online stores, including overpayment requests.
• Fake charity appeals timed to year-end giving.

The Holiday Cybersecurity Checklist at a Glance

Work through this table in priority order. The first five items stop most common attacks and cost little or nothing.

Priority	Action	Time needed	Done?
1	Turn on MFA for email, bank, payroll, payment processor and domain/website accounts	1-2 hours
2	Set a rule: all payment or bank-detail changes verified by phone	30 minutes
3	Run a 20-minute phishing briefing with every employee, including seasonal hires	20 minutes
4	Update operating systems, browsers, apps, routers and POS devices	1-3 hours
5	Test restoring a file and a full system from backup	1-2 hours
6	Set up a password manager and replace reused passwords	2-4 hours
7	Create individual logins for seasonal staff with limited access	1 hour
8	Review payment security with your card processor	1 hour
9	Separate guest Wi-Fi from business systems	1 hour
10	Write a one-page incident plan with contacts and reporting steps	1 hour

This order follows the Cybersecurity and Infrastructure Security Agency’s Secure Your Business guidance, which lists four essentials to start with (phishing training, strong passwords, multifactor authentication and prompt updates) before moving on to logging, backups and encryption.

Passwords and Multifactor Authentication

Stolen or guessed passwords are among the most common ways criminals get in. Multifactor authentication (MFA) means a password alone isn’t enough; the person also needs a code, an app approval or a physical key.

Checklist

• Turn on MFA for email first. Email is the master key, because password resets for everything else go there.
• Then turn it on for online banking, payroll, accounting software, your payment processor, your e-commerce platform, social media accounts and your domain registrar and web host.
• Use an authenticator app or a hardware security key where available. CISA recommends phishing-resistant MFA where you can get it; text-message codes are better than nothing but weaker.
• Adopt a password manager for the team so everyone can use long, unique passwords without writing them down.
• Replace any reused or shared passwords, especially on admin accounts.
• Remove accounts belonging to former employees and contractors.
• Change default passwords on routers, cameras, printers and POS terminals.

A good password policy for a small team: at least 16 characters (CISA’s recommended minimum), or a passphrase of four or more random words; unique for every account; stored in a password manager; never shared over email or text.

Phishing and Business Email Compromise

Phishing messages try to get someone to click a link, open an attachment, enter a password or send money. Business email compromise is the high-dollar version: criminals impersonate a boss, a vendor or a client to redirect a payment.

Red flags to teach every employee

• Urgency or secrecy: “pay this today,” “don’t tell anyone,” “I’m in a meeting, just do it.”
• A request to change bank account or payment details.
• A request to pay with gift cards, cryptocurrency or a wire to an unfamiliar account.
• Sender addresses that are almost right, such as an extra letter or a different domain ending.
• Links where the web address doesn’t match the company it claims to be from (hover before clicking).
• Unexpected attachments, especially invoices, zip files or “secure documents.”
• Login pages reached from an email link rather than a bookmark.

Rules that stop most payment fraud

1. Call-back rule: any change to payment instructions is confirmed by phone using a number from your own records, not the email.
2. Two-person rule: payments above a set amount (for example, $2,500) need a second person’s approval.
3. No gift card payments, ever. Tell staff in writing that the owner will never ask them to buy gift cards by email or text.
4. Report, don’t delete. Make it easy to forward suspicious messages to one person, and thank people who do.

The FTC’s Cybersecurity for Small Business resources include short guides on phishing, ransomware, business email imposters and tech support scams that work well for a 20-minute staff briefing. The FTC also covers email authentication, the SPF, DKIM and DMARC settings that make it harder for criminals to send email that looks like it came from your domain. Ask your email provider or IT contact to check these are set up.

Backups and Software Updates

Backups

Ransomware locks or steals your files and demands payment. A recent, tested backup that criminals can’t reach is what lets you recover without paying.

• Follow the 3-2-1 approach: three copies of important data, on two different types of storage, with one copy offsite or in the cloud.
• Keep at least one backup disconnected or protected from deletion, so ransomware on your network can’t encrypt it too.
• Back up accounting files, customer records, order history, website files and key documents.
• Check that cloud services you rely on (email, file storage, e-commerce) have their own backup or export options turned on.
• Test a restore. Pick a file and a folder and restore them. Time how long a full restore of your most important system takes.

Updates

• Turn on automatic updates for operating systems, browsers and common apps.
• Update router firmware, POS terminals, card readers and security cameras.
• Update your website software, themes and plugins, and remove any you don’t use.
• Replace devices that no longer receive security updates.
• Schedule big updates for slow hours, not on a Saturday in mid-December.

Payment Security for Stores and Online Shops

If you accept credit or debit cards, you’re expected to protect cardholder data under the Payment Card Industry Data Security Standard (PCI DSS), maintained by the PCI Security Standards Council. Most small merchants meet it by using a reputable payment processor and completing an annual self-assessment questionnaire. Ask your processor which questionnaire applies to you.

In-store checklist

• Use processor-provided or certified card readers, and check them for tampering or skimming devices each morning.
• Keep the POS system on a separate network from guest Wi-Fi.
• Never write down or store full card numbers, and never accept card details by email.
• Give each cashier their own POS login.

Online store checklist

• Use a hosted checkout or payment fields from your processor, so card data never touches your server.
• Turn on fraud tools your processor offers, such as address and security code checks.
• Watch for unusual orders: many orders from one card, mismatched billing and shipping, rush shipping to freight forwarders.
• Never refund to a different card or account than the one used to pay.
• Make sure your site uses HTTPS and that admin accounts use MFA.

Seasonal Staff, Devices and Wi-Fi

Temporary staff are often the least trained and the most targeted. Treat onboarding as part of your security plan.

• Give every seasonal worker their own account. No shared logins.
• Grant only the access each role needs. A packer doesn’t need the accounting system.
• Include a short phishing and gift-card-scam briefing on day one.
• Keep a list of every account and device issued, and remove access on the person’s last day.
• Lock screens automatically after a few minutes of inactivity.
• Encrypt laptops and phones that hold business data, and turn on remote-wipe where available.
• Use a separate guest Wi-Fi network for customers, with a different password from the business network.
• When traveling, avoid logging into banking or admin systems on public Wi-Fi without a VPN or your phone’s hotspot.

If Something Goes Wrong: A One-Page Incident Plan

CISA advises businesses to create an incident response plan and practice it. For a small business, one page is enough. Write it now and print a copy, because if your systems are locked, you won’t be able to open a file to read it.

What to include

1. Who decides. The owner or a named manager, plus a backup.
2. Who to call. Your IT provider, bank, payment processor, cyber insurer (if you have a policy) and attorney.
3. First steps. Disconnect affected devices from the network but leave them powered on; change passwords from a clean device; call the bank immediately if money was sent, since fast reporting can improve the chance of recovering funds.
4. Where to report. File with the FBI at ic3.gov; report fraud to the FTC at ReportFraud.ftc.gov; report cyber incidents to CISA; use IdentityTheft.gov if personal information was stolen.
5. Who to tell. Many states have data breach notification laws if customer personal information is exposed. Check your state’s rules with an attorney.
6. How to communicate. Be prompt, factual and specific about what customers should do. If you need to make a public statement, keep it plain and accurate; our guides on what a press release is and how to write one cover the basic structure.

Consider cyber insurance

Cyber insurance can help cover recovery costs, legal advice and notification costs. Policies vary widely, and many insurers now ask whether you use MFA and backups before they’ll offer coverage, which is one more reason to finish the checklist above.

Frequently Asked Questions

What is the most important cybersecurity step for a small business?

Turning on multifactor authentication, starting with email, gives the biggest protection for the least effort. CISA lists it among its four essentials alongside phishing training, strong passwords and prompt updates.

How do I spot a business email compromise scam?

Watch for urgent requests to pay, change bank details or buy gift cards, especially from a boss or vendor who “can’t talk right now.” Always confirm by phone using a number you already have.

Do small businesses need to follow PCI DSS?

If you accept card payments, your card processor will generally expect you to comply with PCI DSS, usually through an annual self-assessment questionnaire. Ask your processor which one applies to your business.

How often should a small business back up data?

Back up as often as you can afford to lose data. For many businesses, that means daily automatic backups of key systems, with at least one copy offsite or protected from deletion, and a test restore every few months.

Where do I report a cyberattack or online fraud?

Report to the FBI’s Internet Crime Complaint Center at ic3.gov, to the FTC at ReportFraud.ftc.gov, and to CISA for cyber incidents. If money was sent, call your bank right away.

Is free antivirus enough for a small business?

Built-in protection on modern operating systems is a reasonable baseline when kept updated, but it doesn’t replace MFA, backups, updates and staff training. Those layers together stop far more attacks than any single tool.

Block Two Hours Before Black Friday

You don’t need to do everything at once. Put two hours on the calendar this week for the first five items in the priority table: MFA on email and banking, the call-back rule for payments, a short staff briefing, updates and a backup test. Rules and threats change, so revisit the checklist each quarter, and bring in an IT professional for anything beyond your comfort zone.