A practical cybersecurity checklist for Chattanooga small businesses

Small businesses rarely get hit by anything sophisticated. They get hit by a stolen password, a convincing invoice, or an unpatched machine. The list below is ordered by how much risk it removes per hour of effort.

The core ten

1. Multi-factor authentication on email, banking, payroll, and remote access, no exceptions for owners. 2. A password manager, so people stop reusing one password everywhere. 3. Automatic updates on every computer and phone, verified rather than assumed. 4. Backups that are tested by actually restoring something, and that an attacker with your admin password can't delete. 5. Least privilege: most people don't need administrator rights, and former employees need access removed the day they leave.

6. A written rule for payment changes, any request to change bank details gets verified by phone to a known number, always. 7. Email protections turned on: spam filtering, external-sender warnings, and correct SPF, DKIM and DMARC records. 8. An inventory of what you own and who can reach it, including that one server nobody has logged into for a year. 9. Encrypted disks on laptops that leave the building. 10. A one-page plan naming who to call, what to shut off, and where the backups are.

The one that stops the most money loss

Business email compromise costs local companies far more than ransomware. The pattern is unremarkable: a vendor emails new banking details, someone in accounting pays it, the money is gone. The control is a process, not a product, verify by voice, to a number you already had. Write it down and make it acceptable to slow a payment down.

Where AI changes the picture

Phishing is better written than it used to be, and a cloned voice on a voicemail is now cheap. That doesn't call for new software; it calls for verification rules that don't depend on a message sounding wrong. Assume the message will sound right.

How to actually get through the list

Don't attempt it in one week. Pick the top three, finish them properly, write down what you did, then continue next month. Security that's documented and boring survives staff changes. Security that lives in one person's head doesn't.

If you'd like a second set of eyes, that's part of what a Compass review covers, we look at how the work happens and where an access or payment path is quietly exposed.