Internet Safety Checklist for Employees: 15 Habits That Protect Your Business

Nearly every security incident we see at a small business begins with a person doing something ordinary: clicking a link, reusing a password, approving a prompt, sharing a folder with the wrong setting, plugging in a device. None of these people were careless in any way they would recognise; they were busy. This checklist, which folds together three older articles on staying safe online, is written for employees rather than IT people. Fifteen habits, each with a sentence on why it matters. Print it, put it in onboarding, and revisit it when the phishing simulation results come in.

Email and messages

1. Treat urgency as a warning sign. “Pay this today”, “your account will be closed”, “the CEO needs gift cards before the meeting”: pressure is the attacker’s main tool. Slow down, and verify by a second channel you already have, such as the phone number in your contacts rather than the one in the email.
2. Check where a link really goes by hovering over it, and where a message really came from by looking at the full address, not the display name. If in doubt, type the site’s address yourself instead of clicking.
3. Never enter your password on a page you reached from an email. Real services rarely need you to; when they do, go to the site directly. Our phishing quiz shows ten current examples.
4. Confirm changes to payment details by phone, on a number you already had, every time. Vendors’ mailboxes get taken over and used to send new bank details; this one habit stops most invoice fraud.
5. Report anything suspicious, including the one you already clicked. The cost of an incident is measured in the hours between the click and the report, and nobody is in trouble for reporting.

Passwords and sign-in

6. Use a different password for every account, generated and remembered by the company password manager, and make the ones you must remember long passphrases. Our guide to creating secure passwords explains the current rules.
7. Keep multi-factor authentication on, and never approve a prompt you did not start. A prompt out of the blue means someone has your password; deny it and report it. If it keeps happening, this explains why.
8. Do not save work passwords in the browser or share them by email or chat. Use the password manager’s sharing feature for team accounts.

Devices

9. Lock the screen when you step away, even for a minute, and never leave a laptop in a car. Company laptops are encrypted, but an unlocked one is an open door.
10. Install updates when asked, and restart. The update you postpone for a week is the hole the attacker uses on Wednesday.
11. Do not plug in unknown USB drives or install software that IT has not approved. Free tools, cracked applications and “PC optimisers” are the main way malware arrives outside email.
12. Keep company data in company places. Files belong in SharePoint or OneDrive, not in personal Dropbox or Gmail, and on a personal phone only inside the managed work apps.

Wi-Fi and working away from the office

13. Prefer your phone’s hotspot to public Wi-Fi, and use the company VPN or zero-trust connection for company systems regardless. Assume anyone can read a screen in a coffee shop, because they can.
14. Secure the home network you work from: change the router’s default password, keep its firmware current, and use WPA3 if it offers it. Our article on securing a wireless network covers the rest.

Sharing and privacy

15. Share files with specific people, not “anyone with the link”, set links to expire, and think before posting anything about the company, its customers or its travel plans on social media. Attackers build convincing phishing from what people share in public.

What IT does so that these habits are enough

Habits reduce the chance an attack succeeds; technical controls catch what habits miss. Behind every good employee checklist should be multi-factor authentication that is enforced rather than optional, endpoint detection on every computer with someone watching it, email filtering that checks links at click time, updates applied automatically, encrypted laptops that can be wiped, and backups that have been tested. Those are part of every plan in our managed cybersecurity services, and short, regular security awareness training with phishing simulations is how the habits are kept alive. The cyber insurance readiness check shows how the two halves map to the questions insurers ask.

Common questions

Is this checklist enough on its own?

No. Habits reduce the chance an attack succeeds; the technical controls, MFA enforced, endpoint detection, email filtering, patching and backups, catch what habits miss. Businesses need both, and the habits are the cheap half.

How often should staff be reminded?

Short reminders monthly and a phishing simulation every quarter work better than an annual hour-long session that everyone forgets. Our security awareness training runs that way: a few minutes at a time, all year.

Should employees use a VPN on public Wi-Fi?

On a company laptop with endpoint protection, encrypted disks and web traffic that is already encrypted, public Wi-Fi is less dangerous than it was; the bigger risks are shoulder-surfing and leaving the machine unattended. A VPN or zero-trust connection is still required for reaching company systems, and a phone hotspot is simpler and safer than coffee-shop Wi-Fi.

What should someone do if they clicked a bad link?

Report it immediately, to IT or the person named in the incident plan, and say exactly what happened. Nobody is in trouble for reporting; the damage comes from the hours between the click and the report. Change the password if one was entered, and let IT check the machine.

Are personal phones a risk?

Only when company email or files are on them without any management. App protection policies keep company data in a managed container on a personal phone, with a passcode and remote wipe of just that data. That is the arrangement to ask IT for.

Who is responsible if an employee makes a mistake?

The business, which is why the controls exist. A culture that punishes mistakes produces employees who hide them, and hidden incidents are the expensive ones. Train, remind, make reporting easy, and put the technical safety nets in place.

Talk to us

If you would like this checklist run as short, regular training with phishing simulations for your team, we will set it up and send you the first results within a month. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.