Do I need a firewall? A small business security checklist.

Short answer: yes, you need a firewall, but it is not the first thing. Most small businesses get hit through email and passwords, not through a dramatic network attack. Here is the order that matters.

1. Multi-factor authentication on everything

Email, accounting, CRM, cloud files, banking, social accounts. A stolen password without a second factor is a non-event. With no MFA it is the whole company. This is free and takes an afternoon. Do it first.

2. Backups you have actually restored

Cloud apps are not backups; deleted means deleted after thirty days. You want a separate backup of email and files, and once a quarter someone restores a file to prove it works. Ransomware is survivable with backups and catastrophic without.

3. Updates on, old gear out

Phones, laptops, the router, the printer. Anything that can't be updated anymore is a door you can't lock.

4. Email protection and the ten-second rule

Turn on your mail provider's advanced phishing protection. Then teach the team one habit: any email about money, passwords or urgency gets a ten-second pause and a phone call to confirm. Most fraud is a convincing email to the bookkeeper.

5. One password manager for the business

No spreadsheets of passwords, no reuse, no shared "office@" login that six people know. A business password manager costs little and fixes most of this.

6. Now the firewall

A proper business firewall (not the box from the internet provider) does three things the free one doesn't: blocks known-bad traffic in both directions, separates guest Wi-Fi and cameras from the computers that matter, and gives you a log when something goes wrong. For an office with staff, point-of-sale or cameras, it is worth it. For two people on laptops working from cloud apps, MFA and updates matter more.

7. Wi-Fi done properly

Separate networks for staff, guests and devices (cameras, TVs, door controllers). Strong passwords, changed when staff leave. Mesh systems make this easy to do right across a building.

8. Access control

Who has a key, a code, an admin login? When someone leaves, everything they had access to changes the same day. Write the list down before you need it.

9. Staff phones

If staff read company email on personal phones, a lock screen and the ability to remotely wipe company data are the minimum. Microsoft 365 and Google Workspace both do this.

10. A one-page plan

Who do you call, what do you shut down, where are the backups, who talks to customers. Written before an incident, it turns a disaster into a bad day.

What this costs

Items one to five are mostly time and small subscriptions. A business firewall and proper Wi-Fi for a small office is a one-time project plus modest ongoing support. Compared with a week of downtime or a fraudulent wire transfer, it is the cheapest insurance you will buy. We do this as a set for Ottawa businesses, from the firewall to the door.