46% of All Breaches Target Small Business
The most common misconception among Austin small business owners: "We're too small for hackers to bother with."
The reality: small businesses are preferred targets because they have valuable data and rarely have dedicated security staff.
This checklist covers the minimum viable security posture every Central Texas SMB should have in 2026.
Email Security (The #1 Entry Point)
Email is how 91% of cyberattacks begin. Three technical controls stop most of them:
- DMARC configured — tells other mail servers what to do with emails pretending to be from your domain
- DKIM enabled — cryptographically signs your outgoing emails to prove they're legitimate
- SPF record published — lists which servers are authorized to send email on your behalf
- Endpoint Detection & Response (EDR) on all computers (not just antivirus — EDR watches behavior, not just signatures)
- Mobile Device Management (MDM) if employees access work email or files on phones
- Screen lock enforced on all devices (10-minute timeout minimum)
- Full-disk encryption enabled (BitLocker for Windows, FileVault for Mac)
- Multi-factor authentication (MFA) on email, banking, and any cloud application
- Unique passwords for every business account (password manager required)
- Offboarding process documented — former employees' access revoked within 24 hours
- Admin privileges limited to accounts that actually need them
- Automated daily backups of all critical data
- Backups stored off-site or in the cloud (not on the same network as your primary data)
- Backup restoration tested within the last 90 days
- Recovery Time Objective (RTO) defined — how long can your business operate without its data?
- Business-grade router/firewall (not a consumer device)
- Guest Wi-Fi network separate from your business network
- VPN required for remote access to internal systems
- Default router credentials changed from factory settings
- Annual security awareness training for all employees
- Phishing simulation training (most breaches start with a click)
- Incident response plan documented — who do you call when something happens?
- Cyber insurance policy in place (most SMBs are uninsured)
How to check: Enter your domain at mxtoolbox.com/dmarc. A failing grade means you're vulnerable to email spoofing and phishing.
Endpoint Protection
Every device that touches your business data is an attack surface.
Access Control
Most breaches involve credentials that were either stolen, reused, or never revoked.
Backup & Recovery
A ransomware attack is recoverable if you have clean, tested backups. Without them, it's a business-ending event.
Network Security
Your office network is the perimeter between the internet and your business.
Human Factors
Technology controls only work if your team knows how to use them.
Find Out Where You Stand — Free
ConnectEx runs a free domain and email security assessment that shows you exactly which items on this list you're failing — in under 24 hours, with no obligation.
Ready to take action?
Get a free vulnerability scan and see exactly where your business stands.
Get My Free Report