Quick answer: To secure a small business with remote workers, start with five moves: turn on multifactor authentication everywhere, give everyone a password manager, switch on automatic updates, back up critical data and test restoring it, and agree one simple rule: verify any payment or password request through a second channel.
Remote work means your office is now ten kitchens, three cafés and a spare bedroom in another state, or another country. For small businesses in the US and UK, that’s normal and productive. But it also means the security habits that worked when everyone sat in one building no longer protect you.
The good news? The basics that stop most real attacks are cheap, quick, and mostly settings, not products.
This checklist is built around the guidance both governments give small firms. In the US, the Cybersecurity and Infrastructure Security Agency (CISA) sums up its business essentials as phishing training, strong passwords, multifactor authentication and updated software, in its four cybersecurity essentials for businesses. In the UK, the National Cyber Security Centre’s advice for businesses is collected in the government’s cyber security guidance for business collection, including its small business guide and Cyber Action Toolkit. Work through this list once, then recheck it quarterly.
The checklist at a glance
| Area | Do this | Time |
|---|---|---|
| Sign ins | MFA on email, banking, payroll and remote access first | 1 to 2 hours |
| Passwords | Company password manager, unique password per account | Half a day to roll out |
| Updates | Automatic updates on every laptop, phone and router | 30 minutes per device type |
| Backups | Automatic backup of key data, test a restore | Half a day, then automatic |
| Email and phishing | One reporting route, call back rule for payments | 1 hour to agree and announce |
| Home working | Secured home Wi-Fi, separate work accounts, screen locks | 1 hour per person, guided |
| If it goes wrong | Written one page incident plan with phone numbers | 1 hour |
1. Lock down sign ins: MFA everywhere that matters
What to do
- Turn on multifactor authentication (MFA) for email first. Email resets every other password, so it’s the master key to your business.
- Then cover banking, payroll, accounting, your Microsoft 365 or Google Workspace admin accounts, and anything reachable remotely, such as a VPN.
- Prefer an authenticator app or passkey over text message codes where the service offers it. Text codes can be intercepted in SIM swap attacks.
- Use separate admin accounts. Nobody should browse the web or read email while signed in as an administrator, in Texas or in Yorkshire.
2. Give everyone a password manager
Why sticky notes fail remotely
You can’t see a remote worker’s desk, and shared spreadsheets of passwords are an incident waiting for a date. A business password manager, typically $4 to $8 (£3 to £6) per person per month, generates and stores a long, unique password for every account. It lets you share business logins without revealing them. And, crucially, it lets you revoke everything in minutes when someone leaves.
The standard to set
- Every work account gets a unique password of at least 14 characters, generated by the manager.
- No work passwords in personal browsers, texts or notebooks.
- UK teams can use the NCSC’s well known advice for any password that must be memorised: three random words are easier to remember and harder to guess than short, complex strings.
3. Turn on automatic updates, everywhere
Most attacks on small firms exploit software that was already fixed months earlier. Enable automatic updates for operating systems, browsers, office apps, phones, and the router firmware nobody ever checks. Replace anything that no longer receives updates. An unsupported laptop used from a home office in Ohio is exactly as exposed as one in London. This is also why the performance maintenance in our Software guides matters for security, not just speed.
4. Back up like ransomware is a weather forecast
The working rule
- Back up the data that would hurt most: accounts, customer records, documents and your website.
- Keep at least one copy separate from your network, in cloud backup or on an offline drive, so an attack on your systems can’t encrypt the backup too.
- Test restoring a file and a folder every quarter. An untested backup is a hope, not a backup.
- Know your obligations: US firms may have state breach notification duties, and UK firms generally must report a personal data breach to the ICO within 72 hours where there is a risk to individuals.
5. Make phishing boring: one rule and one reporting route
CISA puts phishing training first in its essentials for a reason. Most small business incidents still begin with a convincing message. Remote workers get more of them, on more devices, with no colleague nearby to ask, “does this look odd?”
The two habits that stop most of it
- The call back rule: any request to change bank details, pay an invoice, buy gift cards or share a password gets verified by phone or in person, using a number you already have, never a number from the message itself. This single rule defeats most CEO fraud attempts.
- One reporting route: a single address or button for forwarding suspicious messages, and praise for using it. Fast reporting matters more than never clicking, because attackers reuse the same lure across your whole team within the hour.
6. Secure the home office basics
- Home Wi-Fi: router admin password changed from the default, WPA2 or WPA3 encryption, router firmware updated.
- Work accounts only for work: no customer data in personal email or personal cloud storage, and no personal shopping on the work profile of a shared family laptop.
- Screen locks: automatic lock within a few minutes, on laptops and phones, everywhere, cafés included.
- Video calls: check what is behind you before sharing screens. Customer data on a whiteboard or second monitor travels further than you think.
7. Write the one page “something went wrong” plan
Before an incident, write down: who decides, who calls the bank, who contacts your IT support, insurer, and, in the UK, Action Fraud or, in the US, your local FBI field office or IC3 reporting route. Add how you will reach staff if email is down. Growing your visibility, for example with the AI search work in our guide to getting cited in Google AI Overviews, brings more enquiries and more impersonation attempts. So this plan matters more as your brand grows, not less. More guides like this live in our Cybersecurity section.
What we tell every small team first
When we talk to small business owners about security, most expect a shopping list. Software to buy. A consultant to hire. They look almost disappointed when the answer is mostly settings and habits.
But that’s what we have learned works. The teams that get hurt usually aren’t missing an expensive tool. They’re missing one switched on setting, or one agreed rule for payments, or a backup nobody ever tested. Do the boring basics on this page first. They carry more weight than any product you can buy this week.
Frequently Asked Questions
We only have three people. Do we really need all of this?
You need the same five moves, at a smaller scale. Attackers automate their targeting, so a three person firm in the US or UK isn’t too small to be found. It’s just too small to have an IT department. That’s exactly why MFA, a password manager and tested backups matter so much.
How much does this checklist cost to implement?
The settings are free. Realistic spending is a password manager at roughly $4 to $8 (£3 to £6) per person per month, plus cloud backup that many Microsoft 365 or Google Workspace plans partly cover. For most micro businesses, the whole list costs less per month than one hour of downtime.
Should remote staff use a VPN?
If staff connect to systems hosted in an office, yes, through the business VPN with MFA on it. If everything is already in reputable cloud services with MFA and device sign in rules, a VPN adds less. Never use free consumer VPNs for business access. You’d be trusting an unknown company with your traffic.
What should we do first if we suspect an account has been hacked?
Act in this order: change the password from a clean device and sign out all sessions, check for forwarding rules or new admins the attacker may have added, preserve messages and logs, then tell your bank immediately if money is involved and follow your incident plan for notifications.
Final Takeaway
Remote security isn’t a product you buy. It’s five habits you set once and check quarterly: MFA first, a password manager for everyone, automatic updates, backups you have actually restored, and a call back rule for anything involving money. Do those, and a small team in the US or UK is harder to attack than most large ones. Explore the rest of our Cybersecurity coverage on TechPure. And if you want this checklist adapted to your exact tools, contact TechPure with your team size and the platforms you use.
