Cybersecurity Checklist for Small Businesses in the Philippines

Security is a set of habits, controls, and recovery plans

Small businesses do not need to start with a complex security program to make meaningful improvements. They should start by identifying the accounts, devices, websites, and records that would cause the most harm if they were lost, exposed, or unavailable.

This checklist is intended as an operational starting point, not a certification or legal compliance determination. Businesses that process personal information should review the official Data Privacy Act of 2012 and the National Privacy Commission’s current data-security guidance for requirements relevant to their circumstances.

Five areas to review

1. Review accounts and permissions

Check who has administrator access to the website, hosting account, domain registrar, email platform, code repository, payment services, and internal business tools. Remove inactive accounts and avoid sharing one administrator login among several people.

Use multi-factor authentication where the service supports it. Give each staff member a unique account and only the permissions required for their work. When an employee or contractor leaves, include account revocation in the offboarding checklist.

For custom systems, define roles around real duties. A staff member who enters records may not need permission to export every record, manage user accounts, or change system settings. Review permissions when responsibilities change.

2. Keep software and devices maintained

List the website framework, plugins or packages, operating systems, and third-party services that the business depends on. Assign someone to review updates and confirm that supported versions are in use. Test significant changes in a safe environment where possible, especially when they may affect customer forms, logins, or transactions.

Treat security alerts as a task to assess rather than ignore. Also secure the accounts used to manage updates; a perfectly patched website can still be compromised if its administrator account is exposed.

3. Know what personal and business data you hold

Create a simple inventory of important information: customer contacts, employee files, transaction records, website inquiries, and other sensitive business data. Record where the information is stored, who can access it, why it is needed, and when it should be reviewed or deleted.

The National Privacy Commission explains that organizations processing personal information should use reasonable and appropriate organizational, physical, and technical safeguards. Review the NPC’s access-control and data-security guidance and Data Privacy Act resources. Do not assume that a generic checklist alone establishes compliance; responsibilities vary based on the facts and applicable rules.

4. Make backups useful, not just available

A backup is valuable only if it can be restored and contains what the business needs. Identify which databases, uploads, documents, configuration, and other assets must be recoverable. Restrict access to backup copies and avoid exposing backup files through public website paths.

Write down who can start a restore and how to validate the result. Test recovery periodically. Include the practical dependencies: hosting access, DNS or domain control, encryption keys, software versions, and a way to verify that the restored application works.

5. Prepare for suspicious activity

Staff should know how to report a suspicious email, unexpected administrator login, lost device, or missing data. Write down the first contacts and the steps to preserve useful evidence, limit further access, recover services, and assess whether affected individuals or authorities need to be contacted under applicable requirements.

Do not promise that every incident can be prevented. A plan helps the team respond consistently and reduce confusion during a stressful event.

A simple ownership tracker

The owner may be an internal staff member or an external provider, but responsibility should be explicit. Avoid storing passwords in an unprotected document; use an appropriate credential-management method.

Keep the checklist proportionate to the risk

Start with the controls that protect the most important accounts and records. Expand the review as the business adds users, integrations, customer accounts, or more sensitive data. Security is an ongoing process, so revisit the checklist after a major system change or incident.

For businesses building portals, dashboards, or records-management tools, access control and maintainability should be part of the system design rather than afterthoughts. Explore TechWorksPH’s custom system development service to discuss workflows, user roles, and the requirements your system should support.