A practical, non-technical checklist of the security controls every NZ small business should have in place. Organised by priority — the items at the top stop the most attacks. The items further down address specific risk scenarios. Start at the top and work down.
Key takeaways
- 1☐ MFA enabled for every Microsoft 365 (or Google Workspace) user — no exceptions, including admin accounts
- 2☐ MFA number matching enabled in Microsoft Authenticator (prevents push-bombing)
- 3☐ Legacy authentication protocols blocked in Microsoft 365 (these bypass MFA)
- 4☐ Conditional Access policy blocking sign-ins from outside NZ/AU for most users
- 5☐ Separate admin account for IT administration — not the daily-use email account
Security advice frequently focuses on sophisticated threats and complex solutions. For most NZ small businesses, the highest-impact improvements are straightforward — foundational controls that stop the attacks that actually affect businesses at your scale. Here's a prioritised checklist: tick off the first five before worrying about anything else.
Priority 1: Identity and Authentication
- ☐ MFA enabled for every Microsoft 365 (or Google Workspace) user — no exceptions, including admin accounts
- ☐ MFA number matching enabled in Microsoft Authenticator (prevents push-bombing)
- ☐ Legacy authentication protocols blocked in Microsoft 365 (these bypass MFA)
- ☐ Conditional Access policy blocking sign-ins from outside NZ/AU for most users
- ☐ Separate admin account for IT administration — not the daily-use email account
Priority 2: Email Security
- ☐ SPF record published for your domain with hard fail (-all)
- ☐ DKIM enabled and published for your domain
- ☐ DMARC published at p=quarantine or p=reject
- ☐ Microsoft Defender for Office 365 enabled with Safe Links and Safe Attachments
- ☐ Written payment verification policy — verbal confirmation for any bank account change, regardless of email content
Priority 3: Endpoints
- ☐ Behavioural EDR (SentinelOne or equivalent) on every endpoint — not signature-only antivirus
- ☐ BitLocker encryption on all Windows laptops (enforced via Intune, not manually)
- ☐ Intune enrollment for all company devices with compliance policies
- ☐ Current operating system on all endpoints (Windows 11, macOS current release) — no end-of-life systems
- ☐ Patch management for OS and applications — critical patches applied within 72 hours of release
Priority 4: Data Protection
- ☐ Immutable cloud backup of all business-critical data — not just OneDrive sync
- ☐ Backup tested by restoration to a test environment within the last 90 days
- ☐ Documented offboarding process — all access disabled on last day for departing staff
- ☐ Least-privilege access — staff access only the systems and data their role requires
Priority 5: Awareness and Process
- ☐ Staff training on recognising phishing — at minimum annual, ideally quarterly with simulations
- ☐ Documented incident response contact list — IT provider, insurer, legal advisor
- ☐ Cyber insurance policy reviewed within the last 12 months
- ☐ DNS filtering on office and remote work networks
Using This Checklist
If your business can check every item in Priorities 1 and 2, you've eliminated the controls gap that allows the majority of successful attacks on NZ SMBs. Add Priority 3 and you're protected against most endpoint-based attacks including ransomware. Priorities 4 and 5 address the long tail of risk scenarios and operational resilience.
If you're not sure of the status of any item — particularly email authentication records and MFA enforcement — Optimyze offers a free security assessment that covers every item on this list and provides a clear remediation plan for anything not in place.
Security is not a destination — it's an ongoing state that requires maintenance. Run through this checklist annually, after any significant staff or technology change, and after any industry or sector threat advisory. The gaps you find are the ones attackers are looking for.
