October is Cybersecurity Awareness Month, and this year we made something you can actually use: a one-page office security checklist you can print, tick off at your desk and file away. It covers the handful of habits that stop most of the trouble we see in small offices, and nothing on it needs a security team or a budget meeting.<\/p>\n\n\n\n
Two groups run the month, and each picked its own theme for 2026. CISA<\/a>, the federal cyber defense agency, went with “Securing the Next 250” for the nation’s 250th anniversary. The National Cybersecurity Alliance<\/a> went with “Don’t Make It Easy for Them”, and its headline asks you to “make life difficult for cybercriminals.”<\/p>\n\n\n\n Under the slogans, both say the same thing. CISA’s four core steps for everyone are to avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. That is the whole list. Attackers rarely need anything clever when one of those four is missing.<\/p>\n\n\n\n We like the Alliance’s framing best. Nobody has to become an expert. The goal is to stop being the easy target, so the person trying your door moves on to someone else’s.<\/p>\n\n\n\n The checklist has six short sections. Each line is a yes or no you can answer in a minute.<\/p>\n\n\n\n Every account gets its own long password, and the office keeps shared logins in a password manager instead of a spreadsheet. Change the default passwords on the router, printer and cameras. Then turn on multifactor authentication (MFA) for everyone’s email first, and for banking, payroll and your domain registrar next. Email is the master key: whoever controls it can reset almost everything else. Where a service offers an authenticator app or a passkey, pick that over text-message codes.<\/p>\n\n\n\n Make it easy to report a strange email, with one address or one button and no blame for asking. Confirm any change to payment details or bank accounts by calling a number you already have, never one from the email. And if “IT support” calls out of the blue, hang up and call your own IT back.<\/p>\n\n\n\n Let Windows and Mac install updates on their own, and restart computers at least weekly so the updates actually finish. Browsers, PDF readers and Zoom need the same attention, because attackers go after the apps people forget. Our October Windows updates post<\/a> covers this month’s patches, and our Windows 11 lockdown guide<\/a> covers the settings worth turning on.<\/p>\n\n\n\n CISA’s next step for organizations adds logging, backups and encryption. The checklist asks whether backups run on their own with one copy off-site, whether anyone has tested a restore this year, and whether sign-in and computer logs are kept. The last section is new for 2026 in CISA’s list: have an incident response plan and use it. For a small office that can be one taped-up page saying who to call, how to unplug a computer from the network, and where to report it.<\/p>\n\n\n\n CISA also asks critical infrastructure to practice its “3Rs”: Reduce attack surfaces, Replace end-of-support devices, and Recover quickly to sustain operations. The middle one applies to every office we visit. A computer, router or storage box that no longer gets security updates from its maker will only get riskier, and no setting fixes that. The checklist asks for a replacement date for each one, which turns a vague worry into a line in the budget.<\/p>\n\n\n\n You can do every line on the checklist yourself. If you want help, we do this work every week for small offices around Pierce County. We set up Bitwarden so the whole office shares one vault, put Huntress analysts<\/a> on watch around the clock, and install updates after hours with Action1. You can see each piece and what it costs on our security page<\/a>.<\/p>\n\n\n\nWhat is on the office security checklist<\/h2>\n\n\n\n
Passwords and multifactor authentication<\/h3>\n\n\n\n
Scams and phishing<\/h3>\n\n\n\n
Updates<\/h3>\n\n\n\n
Backups, records and a plan for bad days<\/h3>\n\n\n\n
The step most offices skip: replace<\/h2>\n\n\n\n
What to do this week<\/h2>\n\n\n\n
\n
Where Rainier IT fits<\/h2>\n\n\n\n