Office Security Checklist for Cybersecurity Awareness Month

October is Cybersecurity Awareness Month, and this year we made something you can actually use: a one-page office security checklist you can print, tick off at your desk and file away. It covers the handful of habits that stop most of the trouble we see in small offices, and nothing on it needs a security team or a budget meeting.

Two themes, one message

Two groups run the month, and each picked its own theme for 2026. CISA, the federal cyber defense agency, went with “Securing the Next 250” for the nation’s 250th anniversary. The National Cybersecurity Alliance went with “Don’t Make It Easy for Them”, and its headline asks you to “make life difficult for cybercriminals.”

Under the slogans, both say the same thing. CISA’s four core steps for everyone are to avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. That is the whole list. Attackers rarely need anything clever when one of those four is missing.

We like the Alliance’s framing best. Nobody has to become an expert. The goal is to stop being the easy target, so the person trying your door moves on to someone else’s.

What is on the office security checklist

The checklist has six short sections. Each line is a yes or no you can answer in a minute.

Passwords and multifactor authentication

Every account gets its own long password, and the office keeps shared logins in a password manager instead of a spreadsheet. Change the default passwords on the router, printer and cameras. Then turn on multifactor authentication (MFA) for everyone’s email first, and for banking, payroll and your domain registrar next. Email is the master key: whoever controls it can reset almost everything else. Where a service offers an authenticator app or a passkey, pick that over text-message codes.

Scams and phishing

Make it easy to report a strange email, with one address or one button and no blame for asking. Confirm any change to payment details or bank accounts by calling a number you already have, never one from the email. And if “IT support” calls out of the blue, hang up and call your own IT back.

Updates

Let Windows and Mac install updates on their own, and restart computers at least weekly so the updates actually finish. Browsers, PDF readers and Zoom need the same attention, because attackers go after the apps people forget. Our October Windows updates post covers this month’s patches, and our Windows 11 lockdown guide covers the settings worth turning on.

Backups, records and a plan for bad days

CISA’s next step for organizations adds logging, backups and encryption. The checklist asks whether backups run on their own with one copy off-site, whether anyone has tested a restore this year, and whether sign-in and computer logs are kept. The last section is new for 2026 in CISA’s list: have an incident response plan and use it. For a small office that can be one taped-up page saying who to call, how to unplug a computer from the network, and where to report it.

The step most offices skip: replace

CISA also asks critical infrastructure to practice its “3Rs”: Reduce attack surfaces, Replace end-of-support devices, and Recover quickly to sustain operations. The middle one applies to every office we visit. A computer, router or storage box that no longer gets security updates from its maker will only get riskier, and no setting fixes that. The checklist asks for a replacement date for each one, which turns a vague worry into a line in the budget.

What to do this week

• Print the checklist and walk the office with it. It takes about the length of a coffee.
• Turn on MFA for every email account today, starting with the owner’s.
• Pick one file from last month and restore it from backup to prove the backups work.
• Write the one-page “who to call” sheet and tape it somewhere everyone can find it.
• Put a replacement date next to anything that no longer gets security updates.

Where Rainier IT fits

You can do every line on the checklist yourself. If you want help, we do this work every week for small offices around Pierce County. We set up Bitwarden so the whole office shares one vault, put Huntress analysts on watch around the clock, and install updates after hours with Action1. You can see each piece and what it costs on our security page.

Or start with our free 30-minute assessment. We go through this checklist with you, remotely or on-site, and tell you what to fix first.