IT Security Checklist for
Orlando Small Businesses

Credential theft is the #1 entry point for ransomware. Without MFA, a single leaked password hands attackers full access to email, cloud storage, and business tools. Password reuse across personal and work accounts compounds the risk dramatically.

Active accounts for departed employees are a persistent vulnerability. Many data breaches involve ex-employees accessing systems months after they left. A documented offboarding checklist with same-day account revocation is the fix.

Ransomware typically encrypts local backups first. Offsite backups (cloud or physical off-location) are your last line of defense. "Tested" is key — backups that have never been restored have unknown integrity. Test at least quarterly.

Unencrypted customer data on a stolen laptop is a reportable breach even without misuse. BitLocker/FileVault for device encryption and HTTPS/TLS for data in transit should be baseline. Many SMB compliance requirements (HIPAA, PCI) mandate this explicitly.

A visitor or compromised personal device on your business network can move laterally to servers and file shares. Guest network isolation is a 15-minute router config that eliminates an entire attack vector — most SMBs skip it.

Windows Defender is better than nothing but not sufficient for business use. Modern endpoint detection and response (EDR) tools detect behavioral indicators of attack — not just known malware signatures. One unprotected device on your network is a pivot point.

Most ransomware attacks exploit known vulnerabilities — ones with patches already available. A 30-day patch lag is typical in SMBs; attackers know this. Automated patch management (Windows Update, managed patching) closes this window with zero manual effort.

When ransomware hits, the first 30 minutes determine whether you lose everything. Without a plan, teams disconnect the wrong things, delay notification, and destroy forensic evidence. An IRP doesn't need to be complex — who to call, what to isolate, who to notify.

The average ransomware recovery cost for SMBs is $150K–$500K. General liability doesn't cover cyber events. A cyber policy covers breach response, legal costs, customer notification, and often ransom payment. Premiums for SMBs typically run $1,500–$5,000/year.

Self-assessments catch the obvious gaps. A professional audit finds the non-obvious ones — misconfigured cloud permissions, shadow IT, stale admin accounts, unpatched firmware. Most SMBs have never had one; most breaches exploit exactly the things an audit finds.