AI Security Checklist for Small Businesses: 10 Controls to Implement This Quarter

A small business rarely decides to adopt ten AI tools at once. It happens one subscription at a time. Someone in marketing pastes a draft into a chatbot to fix the tone. A developer drops a model API key into a side project and means to move it later. An operations lead connects a summarizer to the shared drive because it saves an hour a week. Each choice is reasonable. Together they build a surface nobody owns.

The checklist below is ordered for that reality. Cheap, high-impact work comes first, engineering-heavy work later. All ten controls fit inside a quarter, and none of them need a security team you do not have.

Why a Quarter Is the Right Amount of Time

A quarter is long enough to change habits and short enough to survive competing priorities. You are not building a governance program. You are closing the gaps that cause real damage.

Assign one owner. Not a committee — a person who can log into admin consoles, ask uncomfortable questions, and follow up. Budget two to four hours a week. If you only finish the first five controls, you have still removed what attackers look for first: unmanaged accounts, exposed keys, and sensitive data leaving through a chat window.

The Ten Controls, Prioritized

Work down the list. Do not jump to number eight because it sounds more interesting than number three.

1. Inventory every tool, model, and key. Ask each team what they use, then check single sign-on logs and expense reports to find the rest.
2. Put every account behind single sign-on with multifactor authentication. Shared logins and personal accounts go first.
3. Retire unscoped and shared API keys. Issue per-application keys with spend limits, and rotate them on a schedule.
4. Review access against job function. Most people can reach more data than they need, especially data that feeds models.
5. Confirm what vendors do with your data. Get retention, training, subprocessors, and breach notification terms in writing.
6. Classify data, then define what may enter a prompt. Customer records, credentials, and contract-restricted material stay out.
7. Log prompts, outputs, and tool calls. Keep those logs where the application cannot rewrite them, and limit who can read them.
8. Monitor for drift, volume spikes, and unexpected tool use. A short alert list beats a noisy dashboard.
9. Write abuse cases into your incident response plan. Prompt injection, leaked outputs, and poisoned documents need named owners and steps.
10. Publish a one-page policy and train on it. State which tools are approved, what never gets pasted, and how to report a mistake.

Access and Inventory: The First Four Weeks

Most AI risk is access risk wearing a new hat, and an account review is the only control that pays off the same week you do it.

Open the admin console of every tool from the inventory and answer four questions per account: who owns it, what data it can reach, when it was last used, and whether it still needs to exist. Accounts without an owner get disabled, not documented.

Then check the places keys hide:

• Repository code and commit history, where secrets get hardcoded.
• CI/CD environment variables and build logs.
• OAuth grants that let third-party apps read email, files, or calendars.
• Offboarding records — anyone who left in the past year and might still hold a valid key.
• Shared drives and document stores that a retrieval system can index.

Replace shared keys with per-application ones, scope each to the minimum it needs, set a spend limit, and rotate on a fixed schedule. That change alone makes abuse visible: an anomaly now points to one key and one owner instead of a mystery login.

Monitoring Is the Control Most Teams Skip

Watching a model is different from watching a web app. Output is not deterministic, so you cannot write a check for "correct." What you can watch is behavior: request volume per key, requests arriving from unfamiliar networks, tool calls your application does not normally make, unexpected outbound connections from the host, and cost climbing without a matching rise in usage.

Keep the alert list short. Five alerts a week that are always false teach your team to ignore the queue, and an ignored queue is worse than none. Start with three conditions: a key whose volume jumps far past its normal pattern, an outbound connection to a destination you have never seen, and repeated authorization failures against the model endpoint.

Logging deserves the same care. Record prompts, outputs, retrieved documents, and tool calls with timestamps and identifiers that link them to a user. Store logs where the application cannot edit them, restrict who reads them, and set a retention window you can justify. Prompt logs often contain personal or confidential material, so treat them as sensitive records rather than debug output. Retention and privacy obligations vary by jurisdiction and contract — confirm your specifics with a qualified adviser before fixing that window.

Build a Rhythm You Can Keep

Controls decay. Keys get created, people change roles, vendors change terms. Put the work on a calendar so it does not depend on memory:

• Quarterly: access review, key rotation, and a re-check of vendor data terms.
• Monthly: skim alert history and confirm logs are still arriving.
• Every offboarding: revoke accounts and keys on the last day, not the week after.
• Every new AI feature: a short review of what data it touches and what it can do without approval.

Once a quarter, run one abuse case as a tabletop exercise. Pick a scenario — a poisoned document in the retrieval index, or an output that exposes another customer's record — and walk through who notices, who decides, and who talks to customers. An hour of that conversation usually finds more gaps than a new tool.

Start With Three Things This Week

If the full list feels heavy, do these three and schedule the rest: finish the inventory, remove shared credentials, and publish a one-page policy naming approved tools and the data categories that never enter a prompt.

Write an owner's name and a date beside each item. Ninety days from now, the checklist should live in a calendar entry rather than a document, and your team should know exactly who to tell when something looks wrong.

Photo: Ivan S / Pexels