Small Business Cybersecurity Checklist for Nevada: 15 Steps to Take in 2026

If you run a small business in Reno, Sparks, Carson City, or Lake Tahoe, you have probably wondered whether you are doing enough about cybersecurity. You do not need an enterprise budget or an IT department to get most of the protection. You need to do the right handful of things, consistently.

This checklist covers the 15 steps that matter most for a Northern Nevada small business, in roughly the order we would tackle them. It ends with what to do first if you only have a week.

Why this matters now

The FBI’s Internet Crime Complaint Center (IC3) published its 2025 annual report this spring. Reported losses from cyber-enabled crime passed $20 billion in 2025, up roughly 26% from the year before. Business email compromise, where a criminal impersonates a boss, vendor, or customer to redirect a payment, cost victims about $3 billion on its own, and that only counts crimes that were reported.

Small businesses are attractive targets precisely because they move real money with fewer safeguards. The good news is that the most common attacks rely on people making a split-second decision, and that is something you can train and prepare for.

The checklist

Protect your accounts

1. Turn on multi-factor authentication (MFA) everywhere it is offered. Start with email, banking, payroll, your accounting software, and anything with admin access. Prefer an authenticator app or a hardware key over text-message codes. A stolen password alone should never be enough to get in.

2. Use a password manager and unique passwords. Reusing one password across accounts means one breach becomes many. A business password manager lets employees generate and share strong credentials without sticky notes or shared spreadsheets.

3. Limit who has admin access. Give people the access they need for their job and nothing more. The bookkeeper does not need admin rights on the whole network, and neither does the receptionist.

4. Remove access the day someone leaves. Disable accounts, revoke shared passwords, and collect devices on the last day. Former employees with active logins are a common and avoidable risk.

Protect your devices and data

5. Keep everything updated automatically. Turn on automatic updates for computers, phones, routers, and business software. Attackers routinely exploit known flaws that already have a fix available.

6. Use endpoint protection and encrypt laptops. Every computer should run reputable security software, and laptops and phones should have full-disk encryption so a lost or stolen device is not a data breach.

7. Back up your data and test the restore. Follow the 3-2-1 idea: three copies, on two types of storage, with one kept offline or otherwise isolated from your network. Ransomware often destroys connected backups. A backup you have never tested is a hope, not a plan.

8. Secure your Wi-Fi and network. Change default router passwords, use a strong Wi-Fi password, and keep guest and customer Wi-Fi separate from the network your business computers use.

9. Know what data you hold and where. List where customer, employee, and financial information lives, on which systems and in which vendor accounts. You cannot protect, or report on, data you have not identified.

Protect against fraud

10. Set up email authentication (SPF, DKIM, and DMARC). These records make it harder for criminals to send email that appears to come from your domain. Your IT provider or domain host can set them up, and it protects your customers as well as you.

11. Verify every payment change by calling a known number. When a vendor, executive, or customer emails new bank details or an urgent wire request, confirm it by phone using a number you already had, not one in the message. Add a second approver for payments above a set amount. This single habit stops most business email compromise. Read how scammers exploit this in our post on executive impersonation.

12. Be ready for calls, texts, and AI voice scams. Criminals now clone voices and impersonate agencies. We documented a real local example in the Washoe County Sheriff impersonation scam, and another in the Nevada annual list scam that targets new business owners.

Prepare your people

13. Train your team regularly, not once a year. Most successful attacks start with a person clicking, replying, or trusting the wrong message. Short, practical, recurring training works far better than a single annual video. Our security awareness training is built for non-technical staff.

14. Test your team with realistic phishing simulations. Simulations show you where your real risks are and give employees safe practice. Done well, they coach rather than punish. See our guide to phishing simulation best practices, or learn about our phishing simulation service.

Be ready when something goes wrong

15. Write a one-page incident response plan and review your cyber insurance. Decide in advance who to call and in what order: your IT provider, your bank, your insurer, and an attorney. Keep those numbers somewhere you can reach even if your systems are down. Review your cyber insurance policy so you know what it covers and what it requires, since insurers increasingly ask about MFA, backups, and employee training.

What Nevada law expects

Nevada’s data security statutes, in NRS Chapter 603A, apply to many small businesses that keep personal information about customers or employees. In plain terms:

• Reasonable security measures. A business that maintains personal information must use reasonable security measures to protect it (NRS 603A.210). The law does not list specific tools, so what counts as reasonable depends on your business, and documented training and basic controls like MFA and backups help you show it.
• Payment cards. A business that accepts payment cards must comply with the current PCI DSS standard (NRS 603A.215).
• Breach notification. If personal information is breached, the business must notify affected Nevada residents in the most expedient time possible and without unreasonable delay (NRS 603A.220).

Depending on your industry, other rules may apply too, such as HIPAA for healthcare practices and the FTC Safeguards Rule for dealers, lenders, and tax preparers. We are not attorneys and this is not legal advice, so confirm what applies to you with your lawyer or compliance officer.

If you only have a week

You can make a real dent in your risk in a few days. In this order:

1. Turn on MFA for email, banking, and your accounting software.
2. Start a password manager and retire reused passwords.
3. Adopt the “call a known number” rule for any payment or bank-detail change.
4. Confirm your backups work by restoring one file.
5. Schedule a team training session and a baseline phishing test.

Get help making it stick

Checklists only work if they become habits. High Sierra Cyber is a locally owned Reno firm that provides hands-on security training, realistic phishing simulations, and plain-English reporting for small businesses across Northern Nevada, with documentation that supports compliance and cyber insurance requirements.

Not sure where you stand? Tell us about your team and we will point you to the highest-impact next steps. It is free, and there is no sales pressure.