Security cleanup checklist.

A first pass for small businesses that need obvious risks found and fixed before the problem becomes a formal incident.

What to check first.

Every admin account has a named owner and MFA enabled.
Former staff, vendors, and shared accounts are reviewed and removed where they no longer belong.
Backups are not only configured, but restorable enough to trust.
Remote access is limited to the people and devices that actually need it.
Business email has SPF, DKIM, and DMARC records that match the actual sending systems.
Routers, firewalls, and Wi-Fi networks have current admin access, known credentials, and documented settings.
Critical devices and services are listed somewhere other than one person's memory.

One vendor knows email, another touched the router, someone else set up backups, and no one can say what matters most.

Insurance, vendor review, a client security questionnaire, or a compliance project is coming and the basics need to be made defensible.