Logins pile up
Email, POS, payroll, bank tools, the domain, social pages, Google Business Profile. Each one was set up by whoever was around that day, with whatever email they had.
Small Business Cybersecurity Checkup
Get your business accounts in order.
A fixed-scope small business cybersecurity checkup. We sit down together, go through the accounts your business runs on, and fix the common gaps: logins, old access, shared passwords, email, your domain, and backups. You finish with a written list of what is done and what is left.
01Fixed scope, priced up front
02Done with the owner
03A written list of what is left
01 / THE PROBLEM
Business accounts pile up faster than anyone keeps track of them.
Old access stays open
A former employee, a past web designer, or a contractor from two years ago may still have a working login. Nobody meant to leave it there. It just never came up.
Passwords live in a sheet
Shared logins sit in a spreadsheet, a group text, or on a sticky note by the register. It works until someone leaves or the sheet gets forwarded.
No plan for a bad day
If the main email or the business Facebook page gets taken over, the steps usually get worked out for the first time, under stress, while customers are waiting.
02 / WHAT WE CHECK AND FIX
Eight checks, done together, written down.
These are the same basics that free official guidance for small businesses covers, like CISA's Cyber Essentials and the FTC's Cybersecurity for Small Business pages. We fix what we can during the checkup. Anything that needs more time or a vendor goes on the list with a clear next step.
Two-factor login on the accounts that matter
Email first, then bank-connected tools, POS, payroll, your domain registrar, social accounts, and Google Business Profile. We save the backup codes where the right people can find them.
Who still has access
We list every person and outside company that can log in, including former employees, old contractors, and shared logins. Anything that should be gone gets removed.
A password manager for the team
One shared place for business logins instead of a sheet or sticky notes. Staff get only the logins they need, and removing someone happens in one place.
Email authentication for your domain
SPF, DKIM, and DMARC records tell other mail systems which emails really come from you. Spoofed emails using your name become easier to reject, and real invoices are less likely to land in spam.
Domain lock and auto-renew
Your domain runs your website and email. We turn on the registrar lock and auto-renew, check the card on file, and make sure the account belongs to the business.
Backups and a test restore
We pick what you cannot lose, like the customer list, books, files, and photos. We confirm each one is backed up, then restore a sample to see that it works.
A takeover plan
A short written plan for when an account gets taken over: who to call, where the backup codes are, and which steps come first.
Who has access to what
A one-page sheet you keep: each important account, who can log in, where recovery emails and texts go, and when it was last checked.
03 / HOW IT RUNS
Short sessions, your accounts, your hands on the keyboard.
The checkup takes one to two weeks. You stay in control of your logins. I guide, explain, and make changes with you, in person in Tampa Bay or over a screen share.
List the accounts
On the intro call we list the accounts your business runs on and agree on what the checkup covers and what it costs.
Logins and access
Together we check two-factor, who has access, passwords, and recovery settings, one account at a time. Quick fixes happen on the spot.
Email, domain, and backups
We add the missing email records, lock the domain, and run a test restore. DMARC starts in watch-only mode so real email keeps flowing while we confirm the setup.
Handoff
You get the access sheet, the takeover plan, and a list of what is done and what is still open, with a walkthrough and time for questions.
04 / FIT
For owners who run the accounts themselves and want them in order.
This is built for businesses without an IT person. Restaurants, salons, contractors, cleaners, auto shops, and small offices tend to run on a similar handful of accounts.
The checkup fits when...
- Your email, POS, payroll, and social accounts were set up over the years by different people.
- Someone left recently and you are not sure what they can still get into.
- Logins are shared in a spreadsheet, a group chat, or on paper.
- Customers or vendors have received emails pretending to be from your business.
- You want to know where things stand before something goes wrong.
Another first step may fit when...
- An account was taken over today. Start with that provider's account recovery, and your bank if money moved. The checkup can come after.
- You need a formal compliance audit or a penetration test. This is a practical checkup, not a certified audit.
- You already pay an IT provider to manage these settings. Ask them for an access list first. It may cover most of this.
- You want round-the-clock monitoring. This is a one-time checkup with a written handoff.
The outcome
The common gaps closed, and a clear list of what is left.
- 01Two-factor on the accounts that matter
- 02Old access removed and logins in one place
- 03Email records and domain settings in order
- 04A tested backup, a takeover plan, and an access sheet
05 / FAQ
Good questions, straight answers.
Will this make my business secure?
No checkup can promise that, and I will not. This closes the most common gaps in small business accounts and leaves you with a written list of what is still open, so you know where you stand and what to do next.
Do you need my passwords?
No. You log in, and we make the changes together. If I need my own access to something like your domain settings, we create a separate login for me and remove it before we finish. The checkup should not add another shared password.
What are SPF, DKIM, and DMARC, in plain words?
They are settings on your domain that tell other email systems which servers may send email as your business and what to do with messages that fail the check. The FTC recommends them for businesses that send email from their own domain. A wrong setting can block your own real email, so we start DMARC in watch-only mode, read the reports, and tighten it once your real senders, like your invoicing or booking tool, pass.
Will two-factor and a password manager slow my staff down?
A little, at first. Two-factor adds a step at login, and a password manager takes some getting used to. A team plan can also add a monthly bill. We put the extra steps on the accounts that matter most and keep the setup simple enough that people actually use it.
Which two-factor method do you set up?
An authenticator app or a security key where the account supports it. Text message codes only where nothing else is offered, because they are still better than no second step. We save backup codes for each account so a lost phone does not lock you out.
Which password manager do you recommend?
I start with 1Password: it works on every device your team already has, sharing is simple, and removing someone takes seconds. If it does not fit your team or budget, I compare the alternatives with you before you pay for anything. The subscription is in the business's name, so it stays with you.
Is there free guidance we can use instead?
Yes, and it is good. CISA's Cyber Essentials and the FTC's Cybersecurity for Small Business pages cover these basics for free. If you have the time and like doing it yourself, start there. The checkup is for owners who would rather sit down with someone and get it done.
What happens to the things we do not finish?
They go on the still-to-do list with the next step written out, such as a vendor that has to turn on a setting or a backup that needs a bigger plan. You can do them yourself, hand them to someone else, or ask me.
What does the checkup cost?
It depends on how many accounts and people are involved. A shop with a handful of accounts is a smaller job than an office with staff logins across many tools. We agree on the scope and price before work starts.
Why you for this?
I have spent more than 10 years working across software, infrastructure, and security. For this checkup, that means knowing which settings matter for a small business and explaining them without jargon. I work remotely and in person around Tampa Bay, in English and Spanish.
Start with the accounts you rely on
Tell me which login would hurt most to lose.
Bring a rough list of the accounts your business runs on. We will talk through whether a checkup makes sense, or whether a few changes you can make on your own are enough.