Cybersecurity Checklist for SMEs: 20 Essential Measures for 2026

Cybersecurity Checklist for SMEs: 20 Essential Measures for 2026

Cybercriminals are increasingly targeting small and mid-sized businesses. The reason is simple: smaller organisations often have weaker security but still hold valuable data. 43% of all cyberattacks target SMEs. In this checklist we share 20 essential measures every organisation should put in place.

Key takeaways (TL;DR)

• 43% of cyberattacks target SMEs - smaller businesses are attractive targets
• MFA blocks 99.9% of account-based attacks - this is measure number one
• 20 essential measures across 5 categories: identity, endpoints, email, network and data
• Prioritise these 5 first: MFA, EDR, backup, patch management and security awareness training
• NIS2 compliance requires many of these measures from Q2 2026

Identity and access

1. Multi-factor authentication (MFA)

MFA is the single most important measure you can take. It blocks 99.9% of account-based attacks.

Enable MFA for:

• All user accounts
• Admin accounts (mandatory)
• VPN access
• Cloud applications
• Critical internal systems

Best practice: Use authenticator apps rather than SMS. SMS is vulnerable to SIM swapping.

2. Strong password policy

Where MFA isn't possible, strong passwords are essential.

• At least 12 characters
• No common words or patterns
• Unique for every account
• A password manager to keep track of them

Consider: Passwordless authentication with passkeys wherever possible.

3. Least-privilege access

Users get only the permissions they need, and nothing more.

• Regular reviews of access rights
• Just-in-time admin access
• Separate admin accounts
• No shared accounts

4. Single sign-on (SSO)

Sign in securely once for every application.

• Fewer passwords to manage
• Central access control
• Fast offboarding
• Better logging

Endpoints and devices

5. Endpoint detection and response (EDR)

Traditional antivirus is no longer enough. EDR gives you:

• Behavioural analysis to catch unknown threats
• Automatic isolation of infected devices
• Forensic investigation after incidents
• Continuous monitoring

6. Device encryption

Every device that holds company data should be encrypted.

• BitLocker for Windows
• FileVault for Mac
• Native encryption for iOS/Android
• Check compliance through MDM

7. Patch management

Unpatched systems are the easiest way in for attackers.

• Automatic updates for workstations
• Fast patching of critical vulnerabilities
• A test procedure for server updates
• Reporting on patch compliance

8. Mobile device management (MDM)

Central management of every mobile device.

• Device enrolment required
• Enforced compliance policies
• Remote wipe capability
• App management

Email and communication

9. Email security

Email is the primary attack vector.

• Spam and malware filtering
• Link scanning and sandboxing
• Attachment scanning
• Impersonation protection

10. DMARC, DKIM, SPF

Protect your domain against spoofing.

• SPF: which servers are allowed to send email on behalf of your domain?
• DKIM: a digital signature on outgoing mail
• DMARC: instructions for recipients when something doesn't match

Goal: A DMARC policy set to 'reject' to block spoofing completely.

11. Security awareness training

Your people are the last line of defence.

• Regular, short training sessions
• Phishing simulations
• A clear reporting procedure
• No blame culture

Network

12. Firewall and segmentation

Limit lateral movement inside your network.

• Next-gen firewall with inspection
• Network segmentation into separate zones
• No direct internet access for critical systems
• Separate guest Wi-Fi

13. DNS filtering

Block known malicious domains.

• Prevent malware downloads
• Block command-and-control communication
• Works wherever the user is

14. VPN or Zero Trust Network Access

Secure access for remote workers.

• Encrypted traffic
• Authentication before access
• Zero Trust grants access per application, not per network

Data protection

15. Backup strategy

The 3-2-1 rule as a minimum.

• 3 copies of your data
• 2 different media
• 1 copy offsite
• Immutable backups against ransomware
• Regular restore tests

16. Data loss prevention (DLP)

Stop sensitive data from leaking.

• Detection of sensitive information
• Blocking of unsafe sharing
• Encryption of sensitive documents
• Logging of data exports

17. Encryption

Protect data at rest and in transit.

• HTTPS for all web traffic
• TLS for email transport
• Database encryption
• Encrypted communication channels

Monitoring and response

18. Logging and monitoring

You can't protect what you can't see.

• Central log aggregation
• Monitoring of critical security events
• Anomaly detection
• A 24/7 SOC or managed detection

19. Incident response plan

Know what to do when things go wrong.

• Defined roles and responsibilities
• Escalation procedures
• A communication plan
• Contacts with external partners
• Regular drills

20. Vulnerability management

A continuous hunt for weak spots.

• Regular vulnerability scans
• An annual penetration test
• Risk-based prioritisation
• Tracking of remediation

Quick compliance check

Use this checklist to see where you stand today.

Score:

• 0-5: Critical - immediate action needed
• 6-10: Insufficient - significant gaps
• 11-15: Average - important areas to improve
• 16-18: Good - fine-tuning needed
• 19-20: Excellent - maintain and keep improving

Prioritisation

You can't do everything at once. This order delivers the most impact.

Phase 1: Foundations (right away)

• MFA for everyone
• Roll out EDR
• Check your backups
• Email security

Phase 2: Strengthening (shortly after)

• Optimise patch management
• Implement MDM
• Configure DMARC
• Start awareness training

Phase 3: Maturity (after that)

• Implement Zero Trust
• Set up DLP
• Establish a SOC/monitoring
• Vulnerability management

Need help?

Implementing this checklist takes expertise and time. A cybersecurity partner can help with:

• An assessment of your current situation
• Prioritisation and a roadmap
• Implementing the measures
• Managed security services
• 24/7 monitoring and response

Compliance context

These measures also help you comply with:

• GDPR: appropriate technical and organisational measures
• NIS2: cybersecurity for essential and important entities
• DORA: digital operational resilience in the financial sector
• ISO 27001: information security management

Getting started

Cybersecurity isn't a project with an end date. It's a continuous process of improving, monitoring and adapting.

Start with the basics. MFA, EDR and backup - these three measures alone prevent the vast majority of successful attacks. Build out from there.

The question isn't whether you'll be attacked, but when. Make sure you're ready.