General guidance for any business. It isn't a substitute for an assessment of your specific systems. Request one.
EmailHow to spot a phishing email
Phishing emails are designed to make you act fast. Slow down and check before you click.
- Look at the actual sender address, not just the display name.
- Be suspicious of urgency: "your account will close," "pay today," "gift cards needed."
- Hover over links to see where they really go.
- Never change payment or bank details based on an email alone. Call the person at a number you already have.
- When in doubt, forward it to your IT provider instead of clicking.
AccountsTurn on multi-factor authentication
A stolen password is much less useful when a second step is required to sign in.
- Start with email, banking, payroll, and remote access.
- Use an authenticator app instead of text messages where you can.
- Never approve a sign-in prompt you didn't start.
- Keep backup codes somewhere safe and offline.
AccountsUse a password manager
Reused passwords are one of the most common ways accounts get taken over.
- Use a different password for every account.
- Let the password manager generate long, random passwords.
- Protect the password manager itself with a strong passphrase and MFA.
- Remove accounts and access promptly when someone leaves.
DevicesKeep everything updated
Many attacks use vulnerabilities that already have a fix available.
- Turn on automatic updates for operating systems and browsers.
- Don't forget firewalls, routers, printers, and other network gear.
- Replace devices that no longer receive security updates.
- Restart computers regularly so updates finish installing.
DataBack up with the 3-2-1 rule, then test it
Keep at least three copies of important data, on two different types of storage, with one copy off-site.
- Automate backups so they don't depend on memory.
- Keep at least one copy disconnected or immutable to resist ransomware.
- Encrypt backups that leave the building.
- Test a restore regularly. An untested backup is a guess.
Northwest FloridaHurricane-season IT checklist
Plan your technology before a storm is in the forecast.
- Confirm off-site backups are current and restorable.
- Know which systems must come back first and who decides.
- Put critical equipment on battery backup and off the floor.
- Make sure staff can work remotely if the office is closed.
- Keep a printed contact list, including your IT provider: (850) 409-8886.
NetworkSecure your office Wi-Fi
Your wireless network is a door into your business. Treat it like one.
- Use WPA3 (or at least WPA2) with a strong passphrase.
- Put guests and smart devices on separate networks.
- Change default admin passwords on routers and access points.
- Keep router firmware updated.
Remote workWork safely from anywhere
Coffee shops, hotels, and home networks aren't managed by your office.
- Use your company VPN on public or shared Wi-Fi.
- Lock your screen when you step away.
- Keep work and personal accounts separate.
- Report a lost or stolen device immediately.
IncidentWhat to do if you clicked a bad link
Mistakes happen. Speed matters more than embarrassment.
- Disconnect from the network if you downloaded or ran something.
- Change the password you entered, from a different device.
- Call your IT provider right away and describe what happened.
- Watch for unusual sign-in alerts or emails sent from your account.
DevicesRetire old devices securely
Old computers, phones, and drives still hold business data.
- Wipe or destroy drives before disposal or donation.
- Remove devices from accounts, management tools, and MFA.
- Keep a record of what was retired and how.
- Don't forget copiers and printers with internal storage.
