Month-End SMB Security Hub: Your 30-Day Checklist Roundup

This is an index page. It doesn't replace any of the guides.

Each Secure SMB Tech checklist covers one habit: an MFA check, a restore test, an update day, a call list. This hub puts them all on one page, spread across four weeks. At month-end you can see what's done, what slipped, and what to file.

It's for an owner or office manager at a business of about 5 to 50 people. Use it with the guides open in other tabs, or print the roundup table and work down it.

What should a small business review every month for cybersecurity? Confirm updates went on, run a backup restore, look at one offline or locked backup copy, and skim your incident call list. Save a dated note for each one. Recheck MFA coverage every 90 days, or sooner if insurance renewal comes first. Admin cleanup in Microsoft 365 runs quarterly, and the IT host questions come out before renewal.

How to use this hub

• Print the roundup table at the bottom, or copy it into a spreadsheet.
• Follow each link for the steps. This page only tells you which guide fits which week.
• Write the date next to each item when it's done. A blank row is a to-do for next month, not a failure.
• If an IT host does the work, still ask them for the dated proof each guide describes.

Week 1: Identity

• Run a 20-Minute MFA Coverage Drill (if due). Confirm one enforcement path, check enrollment for admins and then everyone, spot-check three real sign-ins, and save a dated log. Run it every 90 days, or sooner if insurance renewal comes first.
• MFA Setup for Small Business on Microsoft 365. The step-by-step setup guide, from checking your license to enrolling the first user and keeping a way back in without weakening MFA. Use it if the drill turns up accounts that were never set up.
• Microsoft 365 Admin Hygiene Checklist (quarterly). Separate admin accounts, a short list of Global Admins, and a quarterly pass to remove stale admins and guests, confirm the audit log, check alerts, and review app consent. Mark it "not due" in the months between.

Week 2: Updates and restores

• Monthly Update Day. A 30-minute routine, booked a few days after Microsoft's second-Tuesday releases. Check CISA's Known Exploited Vulnerabilities list for anything you use. Then confirm Windows, Microsoft 365 Apps, browsers, and router firmware are current, and log one line per item.
• Test Your Backup in 15 Minutes. Restore a real file, open it, and write down the result. The guide suggests the same day every month.

Week 3: Ransomware readiness

• Offline Backup Spot-Check. List every backup copy and who can delete it, then confirm that at least one needs a separate sign-in, a physical disconnect, or a retention lock before anyone can change it. It's a separate check from the restore test.
• Ransomware Protect Checklist (suggested monthly). A one-page list based on CISA's StopRansomware guidance: backups you can restore, MFA on email, remote access, and admin accounts, patched internet-facing tools, and a written contacts list. Tick off whatever this month's drills already proved.
• First 60 Minutes After a Cyber Incident. A minute-by-minute first hour: write down what you see, isolate the device without wiping it, call by phone, lock key accounts from a clean device, and report. Each month, skim it and make sure the phone numbers on it still work.
• EDR Glossary for Small Businesses (suggested monthly). Plain definitions of endpoint detection and response, how it differs from antivirus, and questions for your provider. Read it once, then ask each month who watched the alerts.

Week 4: Vendors, gaps, and the evidence folder

• Ask Your IT Host These 8 Questions Before You Renew (before renewal). Eight questions with examples of good answers, covering MFA proof, recent restores, backup isolation, patching, admin accounts, offboarding, after-hours alerts, and insurance evidence. Use it the month before a renewal, or to follow up on any open answers.
• Houston SMB Security Gaps: Map Each Mistake to a CISA Fix (suggested monthly). A fix-map card that matches each common gap to one CISA practice, an owner step for this week, and the proof to save. Pick two or three rows a month.
• CISA and Houston-Area Resources. A directory of free CISA, NIST, FTC, and Texas pages, which services aren't a general signup, and where to report. Keep it bookmarked next to your call list.
• 5 Security Mistakes Houston SMBs Make. A short read on five common gaps: partial MFA, untested backups, informal offboarding, admin accounts used for daily email, and one-time awareness training. Good for a quick check against your own office.

Suggested monthly rhythm

Move weeks around to fit your calendar. What matters is that each monthly item gets a date once a month. The MFA drill gets its date when it's run, every 90 days or sooner if insurance renewal comes first.

What to file each month

This is general record-keeping, not insurance or legal advice. Ask your broker what your policy actually asks for.

• One folder per month, for example Cyber-Evidence/2026-10/.
• The MFA drill log and a screenshot of the enforcement setting, filed when the drill is run (every 90 days, or sooner if insurance renewal comes first).
• The Update Day log.
• The restore test note: file name, date, who opened it.
• The offline spot-check log.
• Any written IT host answers, with the date received.
• The current call list from the first-hour card.

Name every file with the date, so a later reviewer can see when the check happened.

Printable roundup

Next month

New guides go up on the blog as they're published, and the resources page collects the printables. When a new checklist goes live, it'll get a row here.

Related guides

• Run a 20-Minute MFA Coverage Drill
• Monthly Update Day
• Test Your Backup in 15 Minutes
• Offline Backup Spot-Check

A dated line in a log beats a perfect plan nobody checked. Pick the first blank row and start there.

Educational content only — not legal, insurance, or compliance advice.