What security checks should a small business do?

Review account access, multi-factor authentication, software updates, backups, email protection, device security, vendor access, and sensitive-data storage. Test whether backups restore successfully and make sure there is a simple plan for reporting and responding to an incident. Focus first on controls that protect the systems the business cannot operate without.