Free, printable checklist

Small business network security checklist

This practical checklist is designed for small-business owners and managers who want a clearer view of common network-security risks.

Get help with firewall and network security

Firewall rules and remote access

The firewall has a named owner and a recent review date
Old or temporary rules have been removed
Unnecessary internet-facing ports are closed
Vendor access is documented and limited
VPN access uses individual accounts and multifactor authentication
A current firewall configuration backup exists

Warning sign: If no one can explain what the firewall rules do, it is time for a review.

Business and guest Wi-Fi

Guest Wi-Fi is isolated from staff and business devices
Modern WPA2 or WPA3 encryption is enabled
Former staff and vendors no longer know active credentials
Access-point administration is limited and documented
Business, guest and connected-device traffic are segmented appropriately

Warning sign: Guest devices should never have unnecessary access to business systems.

Accounts and administrative access

Administrative accounts are separate from everyday accounts
Former employee accounts are disabled promptly
Shared administrative passwords are avoided
Multifactor authentication protects important systems
Vendor accounts are reviewed regularly

Warning sign: When everyone has administrator rights, the business is harder to protect and recover.

Endpoint protection and updates

Business devices receive supported security updates
Endpoint protection is active and monitored
Unsupported operating systems are identified
A current inventory of connected devices exists
Lost or stolen devices are covered by a response plan

Warning sign: Unknown and unsupported devices create risk that cannot be managed well.

Backups and recovery

Critical business data is included
Backups are stored separately from primary systems
Cloud-backup access is strongly protected
A representative restore has been tested
Recovery ownership and timing are documented

Warning sign: A scheduled backup is not a recovery plan until a restore has been tested.

Documentation and vendor access

A basic network diagram is current
Key devices, providers and support contacts are listed
Firewall rules, networks and important addresses are documented
Vendor access is limited, reviewed and removable
Important credentials are stored securely

Warning sign: If network knowledge exists only in one person’s head, the business has operational risk.

Turn each answer into an assigned next step.

For each unchecked item, record the affected system, the person responsible, the evidence still needed and a review date. An unknown answer is a reason to investigate; it is not proof of a security failure. Keep credentials and configuration files out of shared checklists.

Use the small business firewall review guide for policy and remote-access questions, or read five network security checks for a practical review sequence. If the findings require a redesign, explore business network design.

Keep the review going

One practical security check each month.

Read this checklist freely, then get a short monthly email with one more check you can use in your business.

Get the Wolex Security Brief

Need help reviewing your network?

Turn the checklist into a prioritized action plan.

Send project details