Small Business & Freelancer Security Checklist
You don't need an IT department to protect client data and get paid safely — you need a short list of the things that actually matter, done consistently. This is that list.
Protect client and customer data
- Only collect the client information you actually need — the less you store, the less you can lose in a breach.
- Encrypt sensitive files (contracts, financial records, ID documents) at rest, and avoid emailing them as plain attachments when a shared, access-controlled link will do.
- Use a password manager to generate and store unique passwords for every client portal, invoicing tool, and vendor account — reused passwords are the single most common way small businesses get breached.
- If you use cloud storage (Drive, Dropbox, etc.), review sharing links periodically — "anyone with the link" access has a way of outliving the project it was created for.
Get paid without getting scammed
- Verify any change to a client's payment or bank details by phone or a known contact method — invoice fraud often starts with a convincing email asking you to update where payment goes.
- Use a dedicated invoicing/payment platform rather than ad-hoc bank transfers where possible; it creates a paper trail and reduces manual errors.
- Be suspicious of new clients who want to overpay and ask for a refund of the difference — a classic overpayment scam.
- Never send sensitive payment details (card numbers, bank credentials) over email or chat; use a secure portal instead.
Lock down your accounts and devices
- Turn on two-factor authentication (2FA) for email, banking, invoicing, and any tool that touches client data — email especially, since it's usually the recovery path for everything else.
- Separate business and personal accounts where you can, even as a solo operator — it limits the blast radius if one gets compromised.
- Keep your operating system, browser, and any accounting/invoicing software updated; unpatched software is one of the easiest ways in for attackers.
- If you or any contractors work from a shared or public computer, never save passwords in the browser on that machine.
Watch for business-targeted phishing
Small businesses are a common target for "urgent invoice," "your account will be suspended," and CEO-impersonation emails, precisely because there's often no IT team double-checking requests. Slow down on any email asking you to urgently pay, click, or share credentials — verify through a second channel before acting, especially for anything involving money or client data.
Have a basic incident plan
— Know where your data actually lives (which tools, which accounts) so you know what to check first.
— Know how to change your most important passwords quickly if something looks wrong.
— Keep a backup of critical files that isn't connected to your main accounts (a separate cloud account or offline drive).
— Know who you'd tell — a client, a bank, a platform's support — if their data or payment info was exposed.
For the account-security fundamentals behind all of this, start with our Cybersecurity Starter Kit, and see our top picks for password managers and VPNs worth using day to day.