The 2026 Small Business Cybersecurity Checklist for West Michigan
The 2026 Small Business Cybersecurity Checklist for West Michigan
Updated April 2026 | By Evolv Technology Solutions, Grand Rapids, MI
Cybersecurity doesn't have to be overwhelming. Whether you run a 10-person professional services firm or a 100-employee manufacturer in West Michigan, the fundamentals are the same.
This checklist covers the 20 essential cybersecurity controls every small business should have in place in 2026. Use it as a self-assessment — if you can check off every item, you're in strong shape. If you can't, you know exactly where to focus.
Identity & Access Controls
1. Multi-Factor Authentication (MFA) on All Accounts
MFA should be enabled on every system that supports it — email, VPN, remote desktop, cloud applications, banking portals, and backup consoles. MFA on email alone is no longer sufficient. This is the #1 control cyber insurers require and the #1 gap we see in West Michigan businesses.
Why it matters: Over 80% of breaches involve compromised credentials. MFA stops the vast majority of credential-based attacks even when passwords are stolen.
2. Unique Admin Accounts
Administrative accounts should be separate from daily-use accounts. Your IT team should not be browsing the web and checking email from the same account that has domain admin privileges.
Why it matters: If a phishing email compromises a daily-use account, the blast radius is limited. If it compromises an admin account, the attacker owns your entire network.
3. Strong Password Policy + Password Manager
Require passwords of at least 14 characters. Eliminate password reuse. Deploy a business password manager (like Keeper or 1Password Business) so employees can use unique, complex passwords without writing them on sticky notes.
Why it matters: Password reuse across personal and business accounts is one of the most common attack vectors. A password manager eliminates this risk.
4. Offboarding Process for Departed Employees
Within 24 hours of an employee's last day, disable all accounts, revoke access to cloud services, rotate any shared credentials they had access to, and retrieve company devices.
Why it matters: Former employee accounts are a frequent entry point for unauthorized access, whether malicious or accidental.
Endpoint & Network Protection
5. Endpoint Detection and Response (EDR) on Every Device
Traditional antivirus is no longer adequate. EDR solutions provide real-time threat detection, behavioral analysis, and automated response. Every workstation and server — including Macs — should have managed EDR.
Why it matters: Modern threats bypass signature-based antivirus. EDR catches what antivirus misses and provides the forensic data needed if a breach occurs.
6. Firewall with Active Threat Management
Your firewall should do more than block ports. It should include intrusion detection/prevention (IDS/IPS), content filtering, and geo-blocking. Firmware should be updated regularly.
Why it matters: An unpatched or misconfigured firewall is as good as no firewall at all.
7. Secure Wi-Fi Configuration
Guest and employee Wi-Fi networks should be separate. WPA3 encryption should be enabled. Default router passwords must be changed. Wi-Fi networks should not broadcast the company name.
Why it matters: An attacker on your guest Wi-Fi should never be able to reach your internal network.
8. DNS Filtering
DNS-level filtering blocks access to known malicious domains before a connection is even established. This stops malware downloads, phishing sites, and command-and-control communications.
Why it matters: It's one of the most cost-effective security layers available and catches threats that email filters miss.
Email Security
9. Advanced Email Filtering
Go beyond Microsoft 365 or Google Workspace built-in filters. Deploy a dedicated email security solution with AI-powered phishing detection, attachment sandboxing, and link rewriting.
Why it matters: Email is the #1 attack vector for small businesses. Default email filters miss sophisticated phishing attacks that specifically target SMBs.
10. DMARC, DKIM, and SPF Configuration
These email authentication protocols prevent attackers from spoofing your domain. All three should be properly configured and DMARC should be set to "reject" (not just "monitor").
Why it matters: Without DMARC enforcement, anyone can send emails that appear to come from your domain — to your clients, your bank, or your employees.
11. Phishing Simulation Training
Run simulated phishing campaigns quarterly. Track who clicks, provide immediate training for those who do, and measure improvement over time. Aim for a click rate below 5%.
Why it matters: Technical controls catch most phishing, but employees are the last line of defense for the attacks that get through.
Data Backup & Recovery
12. Immutable Backups
Backups must be immutable — meaning they cannot be encrypted, modified, or deleted by ransomware. This is typically achieved through WORM (Write Once Read Many) storage or air-gapped backup solutions.
Why it matters: Ransomware specifically targets backup systems. If your backups can be encrypted, they're not backups — they're a false sense of security.
13. Offsite or Cloud Backup
At least one copy of your backups should be stored offsite or in the cloud, separate from your primary network. Follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite.
Why it matters: A fire, flood, or physical theft can destroy your on-premises backups. Offsite storage ensures recoverability even in a worst-case scenario.
14. Quarterly Backup Restore Testing
Test your backup restoration process at least once per quarter. Document the test, including recovery time and any issues encountered. Cyber insurers are now asking for proof of testing.
Why it matters: A backup you've never tested is a gamble. The only way to know your backups work is to restore from them regularly.
Patch Management & Maintenance
15. Automated Patch Management
Critical security patches should be applied within 14 days of release for both operating systems and third-party applications (browsers, PDF readers, Zoom, Java, etc.). Automate this process — manual patching doesn't scale.
Why it matters: Known vulnerabilities with available patches are the easiest attack vector for hackers. Automated patching closes this window.
16. End-of-Life Hardware and Software Inventory
Maintain an inventory of all hardware and software. Flag anything that is end-of-life (no longer receiving security updates) and create a plan to replace or isolate it.
Why it matters: Windows 10 reaches end of life in October 2025. Any devices still running it in 2026 are unpatched and vulnerable. The same applies to old firewalls, switches, and servers.
Compliance & Documentation
17. Written Information Security Policy (WISP)
Every business should have a written security policy that covers acceptable use, data handling, incident response, and employee responsibilities. This is legally required for tax preparers (IRS Pub 4557) and increasingly expected by cyber insurers.
Why it matters: A written policy is the foundation of a defensible security program. Without one, you have no standard to train to, audit against, or hold people accountable to.
18. Incident Response Plan
Document your response plan for a security incident. Who gets called first? How do you contain the threat? Who communicates with affected parties? How do you comply with Michigan's breach notification law?
Why it matters: The first 24 hours after a breach determine the outcome. Without a documented plan, panic and confusion lead to worse outcomes and higher costs.
19. Security Awareness Training for All Employees
Every employee should complete cybersecurity awareness training at least annually, with quarterly reinforcement (phishing simulations, micro-learning modules, security tips). Track completion rates and aim for 100%.
Why it matters: Employees are both the biggest vulnerability and the strongest defense. Regular training reduces human error, which causes the majority of breaches.
Strategic Oversight
20. vCISO or Security Leadership
Someone needs to own your cybersecurity program. For small businesses, a virtual CISO (vCISO) provides strategic security leadership — risk assessments, compliance oversight, vendor security reviews, and board-level reporting — at a fraction of the cost of a full-time hire.
Why it matters: Tools and policies without strategy are reactive. A vCISO ensures your security program evolves with your business and stays ahead of threats, not just responding to them.
How to Use This Checklist
Score yourself honestly. For each item you can confidently check off, give yourself one point.
- 18–20: Strong security posture. You're ahead of most SMBs. Focus on continuous improvement and emerging threats.
- 14–17: Solid foundation with gaps. Prioritize the missing items — especially MFA, EDR, and backups.
- 10–13: Significant exposure. You likely have gaps that cyber insurers would flag and attackers would exploit.
- Below 10: Critical risk. Immediate action needed. Consider engaging a managed cybersecurity provider to close gaps quickly.
Frequently Asked Questions
What cybersecurity does my small business need in 2026? At minimum, every small business needs multi-factor authentication on all systems, endpoint detection and response (EDR), immutable backups, email security, patch management, security awareness training, and a written security policy. Businesses handling sensitive data should also consider vCISO oversight.
How much does cybersecurity cost for a small business? A comprehensive managed cybersecurity program (CaaS) for a 20-50 employee business typically costs $2,000-$5,000 per month. This covers all the controls on this checklist. The cost of a breach for an SMB averages $120,000-$200,000.
What's the most important cybersecurity control for small businesses? Multi-factor authentication (MFA). It's the single most effective control for preventing unauthorized access and the #1 requirement from cyber insurers.
Do I need a cybersecurity provider, or can I do this in-house? Most small businesses lack the in-house expertise to implement and manage all 20 controls on this checklist. A Cybersecurity-as-a-Service (CaaS) provider delivers comprehensive security at a lower cost than hiring internal security staff.
What are the biggest cyber threats to Michigan small businesses in 2026? Ransomware remains the top threat, followed by business email compromise (BEC), AI-powered phishing attacks, and supply chain attacks targeting small businesses through their vendors.
How do I know if my business is a target for cyberattacks? Every business is a target. Automated attacks don't discriminate by size. If your business has an internet connection and stores any data, you are a target. Small businesses are actually preferred targets because they typically have weaker defenses.
What should I do if I score below 14 on this checklist? Contact a managed cybersecurity provider for a security assessment. They'll identify your specific gaps, prioritize fixes based on risk, and implement the controls you're missing. Most businesses can close critical gaps within 30-60 days.
Want a Personalized Assessment?
This checklist gives you the big picture. For a detailed, hands-on evaluation of your business's specific security posture, Evolv Technology Solutions offers a free cybersecurity assessment for West Michigan businesses.
Get your free security assessment →
Evolv Technology Solutions is a cybersecurity-first managed service provider based in Grand Rapids, Michigan, serving small and mid-sized businesses across West Michigan.