A Practical Checklist for Hardening Small Business Email
Most business breaches still start in the inbox. These baseline controls close the obvious gaps without a six-month project.
Email remains the most common path into small business networks. Attackers do not need exotic malware when a convincing invoice or password reset still works.
A practical baseline includes multi-factor authentication on every mailbox, phishing-resistant options where the platform supports them, and clear rules for who can send as shared addresses. Add SPF, DKIM, and DMARC so forged mail is harder to deliver in your name. Keep a short user guide for reporting suspicious messages, and make sure spam and malware filtering are turned on — not merely licensed.
Schedule a quarterly access review for former staff and contractors, and test that shared mailboxes still have current owners. Hardening email will not stop every attack, but it removes the easy wins that still account for a large share of incidents.