43% of cyberattacks target small businesses. In 2023, the average cost of a small business data breach was $200,000. Most small businesses that suffer a breach don't survive the next two years.
The companies that got hit weren't careless. They just didn't have a system. Cybersecurity without a checklist is hope — and hope is not a security strategy.
Here's a 12-point checklist you can use today to find out where your business stands. Work through each item. Be honest. Check it only if it's actually in place — not "we should do that" or "I think someone set that up once."
The 12-Point Cybersecurity Checklist
1. Endpoint protection on ALL devices
Every workstation, laptop, and remote device — not just the server. Attackers find the unprotected side door. Every device on your network needs real-time endpoint protection.
2. Multi-factor authentication on email and key systems
A stolen password is useless if MFA is required. Email is the most common attack vector for SE Wisconsin businesses. MFA takes 20 minutes to set up and eliminates a huge percentage of account-takeover attacks.
3. Regular OS and software patching — at minimum monthly
Most ransomware attacks in 2023 exploited known vulnerabilities that already had patches available. Every workstation, laptop, and server should be on a managed patch schedule.
4. Email gateway defense — anti-phishing and anti-malware
A spam filter is not email security. A proper email gateway includes Advanced Threat Protection: it scans links before you click them, detects spoofed senders, and blocks malware attachments before they reach your inbox.
5. Web filtering to block known malicious sites
Cloud-managed web filtering checks every site request against a continuously updated threat database and blocks access to known dangerous destinations. Runs in the background. Attackers notice it.
6. Encrypted backups — tested monthly, offsite AND cloud
Backups don't count unless they work. Your backups should be encrypted, stored both on-site and in cloud storage, and tested monthly with a verified restore. If you can't say when you last did a test restore, the answer is too long ago.
7. Least-privilege access — employees only see what they need
When an account is compromised, attackers can only access what that account had permission to access. The smaller that footprint, the smaller the breach. Your AR clerk doesn't need HR files.
8. Network segmentation — guest WiFi separate from your business network
Your guest WiFi and your business network should not be the same network. If a customer brings a malware-infected device and connects to your WiFi, network segmentation keeps that infection off your business systems.
9. Annual cybersecurity training for all employees
Human error is involved in 74% of breaches. Annual cybersecurity training — not a 5-minute PowerPoint, but an online training program with updated content — changes employee behavior around phishing and password reuse.
10. Simulated phishing tests to identify vulnerable employees
Training tells employees what to look for. Simulated phishing tests find out if it's working. Employees who click get immediate training. Over time, your click rate drops. This is how you find your most vulnerable people before attackers do.
11. A written incident response plan — reviewed and tested
If your systems were hit by ransomware tonight, what would happen? A written plan, reviewed annually and tested at least once, cuts your recovery time significantly. Every minute of unplanned downtime during an incident costs money.
12. Vendor and third-party access controls
Do you know exactly who has remote access to your systems right now? Vendor access should be documented, scoped to minimum necessary access, and revoked when the engagement ends. "We gave them access and never looked again" is a common attack vector.
Score Yourself
10–12 checked: You're in good shape. Schedule an audit to verify everything is working as intended, not just set up.
7–9 checked: You have meaningful gaps. Some of them are probably being actively exploited — you just don't know it yet.
Below 7: You're a target. Attackers look for exactly the profile you're describing — a business with known vulnerabilities and no active monitoring to catch activity. You need a security review now, not next quarter.
Why Most SE Wisconsin Businesses Fail This Checklist
It's not ignorance. Most business owners know they should be doing more on cybersecurity. The real problem is ownership.
Nobody owns it. IT is reactive — something breaks, someone calls, it gets fixed. But cybersecurity is proactive by definition. The work that prevents a breach happens before anything goes wrong. Without someone actively managing it — monitoring, patching, training, testing — the gaps accumulate. And attackers are counting on it.
Small businesses in Racine, Kenosha, and Milwaukee don't get targeted less because they're small. They get targeted more, because attackers know that small businesses are less likely to have the controls in place.
IDN's Approach: All 12, Included
IDN's managed IT plans cover every item on this checklist. 24/7 monitoring on every device. Monthly patch management. Email gateway defense. Web filtering. Encrypted cloud backups with daily monitoring. Cybersecurity training. Simulated phishing. Incident planning is part of every quarterly review. Vendor access is documented when we onboard your account.
This isn't a list of add-ons. It's what managing IT actually means. The checklist above is IDN's baseline — not our premium offering.
We've served 1,000+ clients across SE Wisconsin since 1995. Our response SLA is 10 minutes. No other IT company in this area publishes that number — because most can't back it up.
- Of cyberattacks target small businesses
- 43%
- Average cost of a small business breach
- $200K
- Of breaches involve human error
- 74%
- IDN response SLA
- 10 min
Get a Free Cybersecurity Audit for Your Business
IDN's free IT assessment includes a direct review of your cybersecurity posture against this checklist. Technology Risk Report + Prioritized Action List showing exactly where you stand. No sales pitch. No obligation. Value: $1,500+. Cost: $0.