Cybersecurity Checklist for WISPs

Why WISP security is different

Most small businesses defend one office network. A WISP defends an office, a core network, and dozens of remote sites that nobody visits for weeks at a time. Each tower router is both critical infrastructure and a physically accessible attack surface. A compromised tower device can be used to intercept customer traffic, pivot into your core, or knock a coverage area offline.

You are also an ISP in the eyes of your customers and, often, of upstream providers. Abuse complaints, botnet traffic from subscriber devices, and DDoS attacks aimed at your network all land on your desk. The checklist below assumes that reality instead of ignoring it.

1. Lock down tower infrastructure

Tower routers, switches and radios are your largest and most exposed attack surface. The fundamentals:

• Replace every default credential and disable unused services and ports on all tower equipment.
• Put management interfaces on a dedicated management VLAN that is unreachable from customer traffic and the public internet.
• Require SSH keys or unique per-device passwords; never share one password across all sites.
• Centralize authentication with RADIUS or TACACS+ so a departing technician's access can be revoked once, everywhere.
• Keep firmware current on routers and radios, with a maintenance window for each site.
• Restrict physical access: locked cabinets, documented key holders and a site-visit log.

For a site-by-site version of this list, see our WISP tower cybersecurity checklist and the companion guide to securing routers at unattended tower sites. The tower security solution page covers how this is typically implemented.

2. Segment the network properly

Flat networks are how a single infected device becomes a company-wide incident. At minimum, separate:

• Customer traffic from network management traffic
• Office workstations and VoIP from the core routing infrastructure
• Guest Wi-Fi from everything else
• Billing and customer-data systems from general office access

Firewalls between segments should default to deny, with rules documented and reviewed on a schedule. If you run BGP or multiple upstreams, make sure route filters and prefix lists are part of the same review — a leaked prefix is an availability incident, not just a routing curiosity.

DDoS exposure deserves its own plan: know which upstream provider offers mitigation, what the escalation path is, and how to reach them at 2 a.m. Our guide to protecting tower infrastructure from DDoS attacks walks through the options.

3. Harden identity and access

Most breaches start with a credential, not an exploit. For a WISP, the priority accounts are the ones that touch network equipment, billing systems and email:

• Multi-factor authentication on email, billing, RMM tools, network management and any remote access — no exceptions for owners or admins.
• Named accounts for every technician; no shared logins on any system.
• A password manager for the team, with unique credentials per system.
• A documented joiner/mover/leaver process so access is granted deliberately and removed the day someone leaves.
• Quarterly access reviews of admin accounts on routers, firewalls and billing platforms.

If identity tooling is a gap, the identity and access management overview covers SSO, MFA and privileged access options sized for smaller operators.

4. Patch on a schedule, not when convenient

Unpatched systems are the most common way commodity attacks succeed. A workable patch program for a WISP office and core looks like this:

• Operating systems and browsers on all office endpoints, patched automatically with reporting.
• Third-party applications — browsers, PDF readers, remote tools — included in the same cycle.
• Network equipment firmware on a defined cadence, with critical vulnerabilities handled out-of-band.
• A written target for how fast critical vulnerabilities get patched, and a metric showing whether you hit it.

The patch management approach and our article on how quickly critical vulnerabilities should be patched cover SLA targets and prioritization in more depth.

5. Protect endpoints and watch for trouble

Every office workstation, laptop and server needs modern endpoint protection with centralized alerting. Traditional antivirus alone is no longer enough for the systems that hold customer data; behavioral detection (EDR) catches what signatures miss, and a managed service (MDR) adds the human eyes most WISPs cannot staff around the clock.

Our comparison of EDR versus MDR versus antivirus explains where each fits. Whatever you deploy, alerts have to go somewhere someone reads — an unmanaged console full of unreviewed alerts is the same as no detection at all.

Centralize logs from firewalls, core routers and key servers too. When something goes wrong, the difference between a two-hour incident and a two-week investigation is usually whether the logs exist.

6. Protect customer data and the office

Subscriber records, payment details and support tickets make you a target even if your network gear is perfect. Treat customer data as its own security domain:

• Know exactly where customer data lives — billing platform, CRM, email, spreadsheets — and who can reach each copy.
• Encrypt laptops and any portable media that hold customer records.
• Keep payment data inside a compliant payment processor rather than storing card numbers yourself.
• Define a retention policy and delete data you no longer need; data you do not hold cannot be breached.
• Train staff on phishing and payment-fraud red flags, and test with simulated phishing a few times a year. Email remains the most common way attackers get in, so an email security layer pays for itself quickly.

7. Back up, and rehearse the bad day

Backups only count if they survive the same incident that takes out production. Follow the 3-2-1 pattern: three copies, two media types, one offsite or offline — and make at least one copy immutable or isolated so ransomware cannot encrypt it too. Test restores regularly; an untested backup is a hypothesis, not a plan.

Pair backups with a written incident response plan: who makes decisions, who talks to customers, when you involve law enforcement or your insurer, and how you preserve evidence. Our guide to building an incident response plan and the walkthrough of what happens during a ransomware attack are good starting points. The backup and recovery page covers immutable backup options.

8. Make it measurable

A checklist you ran once is not a security program. Pick a handful of metrics — patch compliance, MFA coverage, phishing-test failure rate, time-to-restore — and review them monthly. Trends matter more than any single number.

If you want a fast baseline, our security score calculator turns the major control areas into a scored self-assessment you can repeat quarterly. And when renewal season comes around, the answers you prepare for a cyber insurance questionnaire map almost one-to-one onto this checklist — doing the work once serves both.

Finally, remember that security posture and network design are connected. IP addressing hygiene, routing policy and backhaul redundancy all affect resilience; the IP block size calculator and backhaul capacity calculator can help with the planning side while you work through the security items here.