A security calendar for your office

On an iPhone or Mac, open the file and choose Add All. In Outlook, open the file. In Google Calendar on a computer: Settings, Import & export, Import, and choose the file. Nothing is sent to us; it's just a file of reminders.

January

Remove access nobody needs

People leave, volunteers change, and old logins are doors nobody watches.

1. List everyone who can sign in to your email, banking and shared files.
2. Remove anyone who has left, and anyone who no longer needs access.
3. Check the bank's list of people who can send payments, too.

February

Test a backup restore

A backup you've never restored is a hope, not a plan.

1. Pick one important file and restore it from your backup to a different folder.
2. Check it opens, then delete the copy.
3. Write down the date. Insurers often ask when you last tested.

March

Check updates and old computers

Most attacks use holes that already have a fix.

1. On each computer, check that automatic updates are on and nothing is waiting to install.
2. List any computer on a Windows or macOS version that no longer gets security updates.
3. Plan to upgrade or replace those this year.

April

Review your money rules

Tax season brings fake invoices and “new bank details” emails.

1. Remind everyone: call back on a number you already had before changing any payment details.
2. Check that payments over your limit still need a second approver.
3. Check that outgoing-payment alerts are on for the accounts that pay bills.

May

Check the second login step everywhere

A second step keeps a thief out even when they have the password.

1. Check two-step verification is on for every email account, starting with whoever handles money.
2. Check it's on for everyone who can use online banking.
3. Make sure admins use a separate account only for admin work.

June

Give the Wi-Fi and router a check-up

Old routers and default passwords are easy ways in.

1. Check the Wi-Fi password isn't the one printed on the router.
2. Make sure visitors use a separate guest network.
3. Update the router's software, or plan to replace it if the maker no longer supports it.

July

Ask what your insurance covers

Many policies require a call to the insurer before you hire anyone.

1. Ask your agent what your policy covers for a hacked account, a fake invoice payment and a ransom attack.
2. Write down who to call first, and put it in your office playbook.
3. Note your renewal date and what the application asks about.

August

Clean up shared passwords

When one site leaks a password, attackers try it everywhere else.

1. Find any login several people share, and give each person their own.
2. Move the passwords you must share into a password manager.
3. Change any password a former staff member or volunteer knew.

September

Update your office playbook

A plan with old phone numbers fails on the worst day.

1. Check every name and phone number in your office playbook: who decides, who to call, the bank.
2. Update anything that changed.
3. Print a fresh copy and replace the old one.

October

Run the office scam drill

October is Cybersecurity Awareness Month. People who've practiced hang up faster.

1. At a staff meeting, run two or three calls from the office scam drill: the office scam drill
2. Remind everyone to report anything odd right away, even if they clicked. Nobody gets in trouble.
3. Keep the signed sign-in sheet with your insurance papers.

November

Warn staff about holiday scams

Fake invoices, gift card requests from “the boss” and delivery texts peak in November and December.

1. Remind staff: nobody here will ever ask for gift cards by email or text.
2. Check any “urgent” invoice or payment change by calling a known number.
3. Don't tap links in texts about packages or tolls.

December

Give the board a year-end update

Owners and boards decide the budget and the rules. Give them a clear picture once a year.

1. Retake the Small Office Security Checkup: the office checkup
2. Print the board summary and bring it to the next meeting.
3. Ask the board for the decisions on it, and set next year's first fix.