This checklist is brought to you by Forward To Safety — cybersecurity built for real life.
Forward To Safety gives your business the tools and expertise to reduce risk, recognize threats, and respond with confidence.
Three capabilities. One trusted platform.
- Craig AI Library — On-demand cybersecurity training and awareness resources your team can actually use
- Website Safety Checker — Check any link or domain against threat intelligence, blocklists, and infrastructure signals before your employees click
- Forward To Safety Assure — Security visibility and compliance reporting that shows business leaders exactly where they’re exposed — and a prioritized roadmap to close the gaps
According to cybersecurity experts: It’s not a question of “if” your business will experience a cyber incident — it’s “when.” The average data breach costs SMBs $149,000, and 60% of small businesses close within 6 months of a successful cyber attack.
Having a plan NOW — before an incident occurs — is your best defense.
Success requires coordination between TWO teams:
This checklist defines WHO does WHAT and WHEN.
□ Schedule an Incident Response Planning Meeting
□ Confirm Your IT Provider Has:
□ Understand Service Level Agreements (SLAs):
HAVING IT SUPPORT IS NOT THE SAME AS HAVING CYBERSECURITY COVERAGE
Most small businesses rely on someone for IT — an in-house tech person, a managed IT provider, or someone who handles things when systems need attention. They keep things running, fix problems, and manage the day-to-day. That’s genuinely valuable.
But IT and cybersecurity are different disciplines — and this distinction matters more than most business owners realize.
An IT generalist is focused on keeping your systems operational. A cybersecurity professional is trained to look for something different: software running on your network that hasn’t been updated in months and is leaving a known opening for attackers, settings that were misconfigured and are quietly exposing more than they should, user accounts that still have access they no longer need, or compliance gaps your business is expected to close before an audit finds them.
These are the kinds of things that often go unnoticed — by IT teams and business owners alike — until something goes wrong and the source becomes obvious in retrospect.
And if your business doesn’t have dedicated IT support at all — which is true for many small businesses — no one may be looking at any of this.
Forward To Safety Assure gives you that view, in plain language, without needing a technical background to read it.
Assure is a security visibility and compliance reporting platform designed for business leaders. It shows you what’s actually going on across your systems:
- Software and systems that need updating before they become an entry point
- Settings and access points that are open when they shouldn’t be
- User accounts with more access than necessary — or access that was never removed
- Where your business stands against compliance requirements like HIPAA, PCI-DSS, SOC 2, NIST, and GDPR
A regularly updated dashboard. Reviewed quarterly with a prioritized action plan using tools you already own. Written for leaders, not IT teams.
See what’s actually going on in your business. Learn more at forwardtosafety.com
□ Assign Clear Roles and Responsibilities:
| ROLE | PERSON | BACKUP | 24/7 CONTACT |
|---|---|---|---|
| Incident Commander (Final authority for all decisions) | _______ | _______ | _______ |
| IT Liaison (Bridge between business and IT provider) | _______ | _______ | _______ |
| Communications Lead (Internal/external messaging) | _______ | _______ | _______ |
| Legal Counsel | _______ | _______ | _______ |
| HR Representative | _______ | _______ | _______ |
| Finance/Accounting Lead | _______ | _______ | _______ |
| Customer Relations Lead | _______ | _______ | _______ |
□ Define Decision-Making Authority:
Print and store in multiple secure locations (office, cloud, key personnel homes)
□ Emergency IT Provider Contacts:
□ Critical Business Contacts:
□ Regulatory/Law Enforcement Contacts:
□ Key Vendor/Partner Contacts:
□ Alternate Communication Methods:
Work with your IT provider to create and maintain this inventory:
□ Critical Systems Inventory:
□ Data Classification:
□ Business Impact Assessment:
□ Identify Your Notification Obligations:
Which regulations apply to your business?
[ ] HIPAA (Healthcare)
□ Document Notification Timelines:
□ Confirm Cyber Insurance Coverage:
Work with legal counsel to pre-draft these templates:
□ Internal Communications:
□ External Communications:
□ Customer Service Talking Points:
□ Leadership Training (Quarterly):
□ Employee Awareness (Monthly):
□ Tabletop Exercises (Every 6 Months):
SECURITY THREATS CHANGE CONSTANTLY — MOST EMPLOYEE TRAINING DOESN’T
Most businesses do security training once a year. That worked better when threats were more predictable. Today, scam emails are updated constantly — and an employee who completed their training in January may not recognize what’s circulating in September.
Here’s what that gap looks like in practice: a new type of scam email starts making the rounds — one that looks like a routine invoice or vendor payment request, formatted to appear completely normal. An employee gets one and isn’t sure if it’s real.
With Forward To Safety, they don’t have to guess. They forward it to [email protected] — or use the Forward To Safety extension — and in less than 30 seconds they get a detailed verdict: exactly what was found, why it’s suspicious, and what to watch for. Forward To Safety analyzes emails, texts, PDF files, QR codes, voicemails, and virtually anything sent through technology — not just email.
That verdict is also real-time training. Because the explanation is tied to an email the employee actually received — not a hypothetical in a classroom — it sticks. Do this enough times and something more valuable happens: your team stops second-guessing and starts building the habit of checking before trusting. That habit, repeated daily, is more effective than any annual training session.
And the everyday questions that come up beyond that? “What does this security warning mean?” “Should I be concerned about this popup?” “My IT provider mentioned something I didn’t understand — what does that actually mean for us?” That’s where the Craig AI Library comes in.
Built by cybersecurity expert Craig Peterson, the Craig AI Library is your team’s go-to resource for plain-language answers to the technical questions that come up day to day — without waiting for the next training session or bothering the IT provider for every small question.
Use it for:
- Everyday security questions employees don’t know who to ask
- Understanding what security terms and warnings actually mean in plain language
- Helping new hires navigate common security situations from day one
- Keeping awareness current throughout the year without scheduling another training sessionGive your team knowledge that stays current. Access the Craig AI Library at forwardtosafety.com
□ Confirm with Your IT Provider:
□ Request Backup Testing:
□ Maintain Offline Backups:
DO YOU KNOW ENOUGH TO EVALUATE WHAT YOUR IT PROVIDER TELLS YOU ABOUT BACKUPS?
The questions above are the right ones to ask. But knowing whether the answers you receive are actually adequate — that’s a different challenge. Most business leaders ask and then accept whatever they’re told, not because they don’t care, but because they don’t have the background to push back when something doesn’t add up.
What does a good backup schedule actually look like for a business your size? What’s a reasonable recovery time? What’s the difference between having a backup and having a tested backup? When an IT provider says “we’re covered,” what does that really mean?
The Craig AI Library gives you the background to evaluate those answers — plain-language explanations of backup and recovery concepts, what to look for, and what questions to ask when an answer feels incomplete. No technical background required.
Go into your next IT review prepared — not just with a checklist, but with enough understanding to know when the answers you’re getting are the right ones.
Explore the Craig AI Library at forwardtosafety.com
Train all employees to immediately report these indicators:
□ System/Network Anomalies:
□ Account Compromise Indicators:
□ Business Operations Disruptions:
□ Financial Red Flags:
WHAT YOUR EMPLOYEES DON’T KNOW CAN HURT YOUR BUSINESS
How Hackers Hide Inside Legitimate Websites — Without the Owner Ever Knowing
One of the most dangerous threats your business faces isn’t a shady link or an obvious scam email. It’s your vendor’s website. Your industry news site. Your supplier’s invoice portal. Legitimate, familiar websites that have been quietly compromised — and the owners have no idea.
Here’s how it works:
Silent Code Injection
Attackers exploit vulnerabilities in a website’s software — outdated plugins, unpatched content management systems, or insecure third-party scripts — and inject malicious code that runs invisibly in the background. The site looks completely normal to everyone: visitors, employees, and the website owner. Nothing appears wrong because nothing visible has changed.You Don’t Have to Click Anything
When an employee visits a compromised legitimate site, malicious code can execute automatically — downloading malware, harvesting credentials, or quietly redirecting to a fake login page — all while the real website displays normally in the foreground. The attack happens without a single suspicious click.Watering Hole Attacks Target YOUR Industry
Sophisticated attackers identify which websites their intended victims visit regularly — trade publications, association portals, supplier websites, industry forums — and deliberately compromise those specific sites to reach them. Your business gets targeted through the sites your employees trust most.Malicious Ads on Legitimate Sites
Even websites that haven’t been directly hacked can serve threats. Attackers inject malicious code into legitimate advertising networks, which then deliver that code to visitors through normal ad placements on reputable websites — a technique called malvertising. The site’s owner is completely unaware.Why “Stick to Trusted Sites” Is Dangerous Advice
The most common — and most wrong — advice in cybersecurity is to simply avoid “sketchy” websites. The reality: legitimate websites get compromised every single day. Site owners are often the last to find out, sometimes only learning of the infection when customers or security researchers report it. By then, thousands of visitors may already be affected.The bottom line: your employees cannot tell a compromised site from a safe one just by looking at it.
WHEN AN EMPLOYEE ISN’T SURE ABOUT A LINK, WHAT DO THEY DO?
Read the section above. Now consider this: when someone on your team gets an email with a link they’re not quite sure about — a vendor invoice, a payment request, a supplier portal — what’s their actual next step?
For most employees, the honest answer is: click it and hope, or skip it and possibly miss something important. “Use your judgment” is the most common guidance given. But as you just read, judgment alone can’t catch a website that looks completely normal but has been quietly compromised. The page loads fine. The address looks right. There’s nothing visibly different.
The Forward To Safety Website Safety Checker gives your team a simple way to check before clicking.
Before visiting any link, employees can run a quick check — the tool looks at the site’s history, reputation, security certificate, whether it appears on known threat lists, and where the link actually leads. Free to use, no account needed, takes about 10 seconds.
Paid accounts add checks across 35+ additional security sources and AI-powered review of the page content itself.
Build it into a simple habit:
- Check any link that arrives unexpectedly in an email, invoice, or payment request
- Verify a vendor or supplier site when accessing it from an unfamiliar URL
- Any time something feels a little off — take 10 seconds to check before clickingFree to use, no account required. Try the Website Safety Checker at forwardtosafety.com/check
Create a simple, clear reporting process:
□ Employee Discovery Process:
□ IT Liaison Actions (First 15 Minutes):
Your IT provider should immediately:
□ Triage the Incident (30-60 Minutes):
□ Classify Incident Severity:
LEVEL 1 — CRITICAL (Activate Full Response):
LEVEL 2 — HIGH (Enhanced Monitoring):
LEVEL 3 — MEDIUM (Standard Response):
LEVEL 4 — LOW (Monitoring Only):
Your IT provider should be collecting:
□ Technical Forensics:
□ Business Documentation:
□ Activate Incident Response Team:
□ Make Critical Business Decisions:
□ Initiate Internal Communications:
Your IT provider should be:
□ Containing the Threat:
□ Stopping Active Attacks:
□ Assessing Damage:
□ Stakeholder Management:
□ Business Continuity:
□ HR Considerations:
□ Documentation:
Your IT provider should continue:
□ Deep Investigation:
□ Enhanced Monitoring:
□ Communication with Business:
□ Ransomware Scenarios:
□ Law Enforcement Notification:
□ External Forensics:
□ Approve Recovery Plan:
□ Business Continuity Management:
□ Begin Regulatory Compliance:
Your IT provider should:
□ Eradicate Threats:
□ Restore Systems:
□ Enhance Security Posture:
□ External Notifications (if required):
□ Customer Relations:
□ Financial Management:
Your IT provider should:
□ Verify Security:
□ Enhanced Monitoring (30-90 Days):
□ Post-Incident Review Meeting:
□ Document Lessons Learned:
□ Update Incident Response Plan:
□ Strategic Review:
□ Organizational Changes:
□ Long-term Monitoring:
Your IT provider should:
□ Implement Security Enhancements:
□ Update Security Roadmap:
□ Review Security Alerts:
□ Employee Awareness:
MONTHLY SECURITY REMINDERS WORK BETTER WHEN THEY’RE SPECIFIC AND CURRENT
A quick reminder to “stay vigilant” is easy to send — and easy to ignore. What makes monthly security awareness actually land is specific, timely information: here’s something going around right now, here’s what it looks like, here’s what to do if you see it.
The Craig AI Library gives you that material. Clear, plain-language cybersecurity guidance from Craig Peterson — covering what’s relevant right now, explained in a way anyone on your team can follow.
Use it for team briefings, lunch-and-learns, or a quick read between quarterly exercises. Real examples. Current topics. No technical background required.
Keep your team’s awareness current all year. Access the Craig AI Library at forwardtosafety.com
□ Incident Response Team Meeting:
□ IT Provider Review:
□ Comprehensive IR Plan Review:
□ Full-Scale Incident Simulation:
□ Security Posture Assessment:
PRINT AND STORE IN MULTIPLE LOCATIONS
| CONTACT | NAME | PHONE | NOTES | |
|---|---|---|---|---|
| Incident Commander | ___ | ___ | ___ | Final decision authority |
| IT Provider Emergency | ___ | ___ | ___ | 24/7 hotline |
| IT Liaison (Internal) | ___ | ___ | ___ | Primary tech contact |
| Backup IT Liaison | ___ | ___ | ___ |
| CONTACT | NAME | PHONE | NOTES | |
|---|---|---|---|---|
| Legal Counsel | ___ | ___ | ___ | |
| Cyber Insurance | ___ | ___ | ___ | Policy #: _ |
| Communications Lead | ___ | ___ | ___ | |
| HR Representative | ___ | ___ | ___ | |
| Finance Lead | ___ | ___ | ___ |
| CONTACT | PHONE | WEBSITE | NOTES |
|---|---|---|---|
| Forward To Safety Support | ___ | forwardtosafety.com | 24/7 incident support |
| FBI IC3 | N/A | www.ic3.gov | Internet crime reporting |
| FBI Local Office | ___ | ___ | For major incidents |
| Business Insurance | ___ | ___ | Policy #: _ |
| Bank Fraud Dept | ___ | ___ | |
| PR Consultant | ___ | ___ | If needed |
| IF THIS FAILS | USE THIS INSTEAD |
|---|---|
| Personal cell phones: ___ | |
| Office phones | Personal mobile: ________ |
| VoIP | Conference line: ________ |
| Building inaccessible | Meet at: __________ |
Plan for potential incident costs:
Recommendation: Budget 2–5% of annual revenue for cybersecurity, including incident response capabilities.
Note: Forward To Safety Assure is priced for SMBs — a dashboard, compliance reporting, and quarterly advisory guidance at a fraction of what enterprise SIEM tools cost. Knowing where you’re exposed before an incident is far less expensive than discovering it during one. Learn more at forwardtosafety.com.
Complete this review every 12 months:
□ Update all contact information
□ Review and test backup procedures
□ Verify cyber insurance coverage is adequate
□ Update regulatory compliance requirements
□ Review and update communication templates
□ Conduct full tabletop exercise
□ Review IT provider SLAs
□ Update asset inventory
□ Verify employee training is current
□ Review lessons from any incidents (yours or industry)
□ Update plan for organizational changes
□ Get executive/board approval on updated plan
Last Reviewed: _______
Next Review Due: _______
Approved By: _______
Success requires active partnership between your business leadership and your IT/cybersecurity provider. Neither can succeed alone:
This plan should be:
You just worked through a detailed incident response plan. Before you file it away, consider three questions:
As a business leader, can you see your own security status right now — what’s patched, what’s at risk, where you stand on compliance — without having to ask your IT provider to pull something together?
When an employee gets an email or link they’re not sure about, do they have a simple tool to check it — or are they left to their own judgment?
Is your team’s security awareness current as of this month, or based on the last training you scheduled?
If any of those feel like open questions, this checklist tells you what to do when something goes wrong — but it doesn’t fill those gaps before something goes wrong.
That’s what a Forward To Safety subscription is for.
START YOUR FORWARD TO SAFETY SUBSCRIPTION
Forward To Safety analyzes anything suspicious your team receives — emails, texts, PDF files, QR codes, voicemails, and any content sent through technology. Forward it to [email protected] and get a detailed threat verdict in less than 30 seconds — 6-tier analysis, 25+ attack categories, no software to install.
Business plans start at $1,962/year.
Subscribe now at forwardtosafety.com
Know what’s actually going on in your business — without needing an IT background.
Most business leaders assume their IT provider has cybersecurity covered. But IT and cybersecurity are different disciplines — and the gaps often show up in places no one was specifically looking: software that needed updating months ago, settings that are open when they shouldn’t be, user accounts with access that was never removed.
Forward To Safety Assure surfaces those issues in plain language — a regularly updated dashboard showing where your software stands, what access controls have gaps, and how your business measures up against compliance requirements. Quarterly reports give you a clear, prioritized action plan using tools you already own.
You don’t need a technical background to read it. That’s the point.
Cybersecurity training your employees will actually remember.
Built by Craig Peterson — one of America’s most trusted cybersecurity voices — the Craig AI Library delivers clear, practical security education your whole team can use. Turn “security awareness” into year-round preparedness.
Check any link before your team clicks it.
Forward To Safety’s Website Safety Checker runs 10 checks — DNS, SSL, domain age, blocklists, threat intelligence feeds, redirect chains — on any URL before anyone on your team visits it. Free with no account required. Paid accounts add 35+ security engine analysis and AI-powered page content scanning. Install the bookmarklet for one-click checking on any page.
Forward anything suspicious — emails, texts, PDFs, QR codes, voicemails — directly to [email protected] for a full 6-tier threat analysis and a verdict in less than 30 seconds.
Ready to protect your business?
Visit forwardtosafety.com to learn more or schedule a free consultation.
Your incident response plan is only as good as your preparation. The time to act is NOW — before you need it.
Brought to you by Forward To Safety — Protecting SMBs from the threats that matter.
Join thousands of security professionals who receive Craig Peterson's Insider Show Notes and cybersecurity updates.
Join 10,000+ cybersecurity professionals