Cybersecurity Checklist for Kenyan SMEs: Practical Controls to Start With
Cybersecurity can feel overwhelming because the subject is often discussed in terms of advanced attacks and expensive tools. For most small and growing businesses, however, a large amount of risk can be reduced by consistently applying basic controls across accounts, websites, devices, backups and staff access.
This checklist is a practical starting point for management teams that want stronger security without turning every business process into a technical project.
1. Use multi-factor authentication
Enable multi-factor authentication on email, cloud platforms, website administration, financial systems and other critical accounts wherever it is available. A password alone should not be the only barrier protecting an important business system.
2. Remove accounts that are no longer needed
Old staff accounts, temporary developer logins and forgotten administrator users create unnecessary exposure. Review users regularly and remove or downgrade access that is no longer justified.
3. Give people only the access they need
Not every employee needs administrator access. Use role-based permissions so users can complete their work without having unrestricted control over systems or data.
4. Keep software updated
Operating systems, browsers, plugins, themes, applications and server software should be patched consistently. Delayed updates can leave known vulnerabilities exposed long after fixes are available.
5. Protect the company website
Business websites are common targets because they are public and often use third-party plugins. Maintain backups, remove unused plugins, keep the CMS updated, protect administrator access and monitor for unexpected pages, users or code changes.
If you are concerned about a website or infrastructure issue, Zubrify provides cybersecurity and data protection services.
6. Maintain tested backups
A backup is only useful if it can be restored. Keep copies separate from the system they protect, define how often important data should be backed up and periodically test recovery.
7. Secure email accounts
Email is connected to password resets, financial conversations, cloud invitations and sensitive files. Protect accounts with multi-factor authentication, strong unique passwords and clear processes for suspicious messages.
8. Keep business devices protected
Use screen locks, device encryption where available, supported operating systems and reputable endpoint protection. Lost laptops and phones can become data incidents if devices are not properly secured.
9. Know where sensitive data is stored
Teams cannot protect information they cannot locate. Identify where customer records, employee information, financial files, credentials and important documents are stored, who can access them and how they are shared.
10. Control third-party access
Developers, agencies, vendors and contractors often receive temporary access. Record that access, use named accounts where possible and remove permissions when the work is complete.
11. Prepare for an incident
Decide in advance who should be contacted if an account is compromised, a device is stolen, the website is altered or important files become unavailable. The first hour of an incident is not the right time to decide who is responsible.
12. Train staff around realistic risks
Security awareness should be practical. Staff should know how to recognize suspicious login prompts, payment-change requests, unexpected attachments, password-reset messages and requests for confidential information.
A simple monthly security review
- Check administrator and user accounts.
- Confirm important systems are updated.
- Review backup status.
- Check website health and unexpected content.
- Review any unusual login or security alerts.
- Remove old third-party access.
- Record incidents and lessons learned.
Security should support the business
The objective is not to eliminate every possible risk. It is to understand the risks that matter most and reduce them in a structured way. Zubrify can help with assessments, hardening, remediation and ongoing IT support. For a security review, contact our team.