Business IT and cyber security checklist
30 practical checks for small businesses and organisations across South West England. Work through them yourself, or ask us to go through them with you.
Proudly serving South West England from our Kingsbridge base in the South Hams, Devon, extending across Devon and Cornwall. This checklist reflects the problems we see most often in organisations across the region. Each point is something you can check today. Tick off what is in place, and note what is not.
Accounts and sign-in
Most incidents in small organisations start with a stolen or guessed password.
- Multi-factor sign-in is switched on for every email and Microsoft 365 or Google account.
- Nobody uses an administrator account for everyday work.
- Shared logins have been replaced with named accounts wherever the system allows it.
- Staff use a password manager rather than reusing passwords.
- Accounts for people who have left are disabled on their last day.
Devices
Every laptop, desktop and phone that touches business data is part of your security.
- Operating systems and apps install updates automatically, and someone checks they have.
- Every device has security software running and reporting.
- Laptops and phones are encrypted and lock automatically.
- You have a current list of devices and who uses each one.
- Old devices are wiped securely before they are sold, recycled or passed on.
Email and scams
Email is still the main route in for scams, invoice fraud and malware.
- Email filtering is in place for spam, phishing and malicious attachments.
- Your domain has SPF, DKIM and DMARC records set up.
- Changes to supplier bank details are always confirmed by phone on a known number.
- Staff know how to report a suspicious email and who to tell.
- External emails are clearly marked so staff can spot impersonation.
Backups and recovery
A backup only counts if it can be restored when you need it.
- Important data, including Microsoft 365 or Google data, is backed up.
- At least one backup copy is kept separate from the systems it protects.
- A test restore has been done recently, and it worked.
- You know how long it would take to get running again after a serious outage.
- There is a short written plan for what to do if systems are lost or locked.
Network and WiFi
Routers and WiFi are easy to forget once they are working.
- The router and firewall admin passwords have been changed from the defaults.
- Router and firewall firmware is up to date.
- Guest WiFi is kept separate from the business network.
- Remote access to your systems goes through a secure, protected route.
- You have a plan for staying online if the main connection drops.
People, policies and suppliers
Clear, simple rules that people actually follow beat long documents nobody reads.
- You have a short IT and security policy that staff have read.
- New starters are set up, and leavers removed, using the same steps every time.
- Someone is responsible for IT and security decisions, even if support is outsourced.
- You know which suppliers hold or can reach your data, and how they protect it.
- Security basics are refreshed with staff at least once a year.
Want a second pair of eyes?
We can review your set-up against every point, write down what we find and give you a prioritised plan. Call 01548 859773, message us on WhatsApp or use the contact form.
Cyber security servicesIT support across the South WestHow we work
Frequently asked questions
Who is this checklist for?+
Small businesses, charities, practices and other organisations in the South West that want a clear picture of their IT and cyber security basics without technical jargon.
What should we do if we cannot tick everything?+
Start with accounts and sign-in, then backups. Those two areas prevent and recover from the most common problems. We can help you put the rest in a sensible order.
Can you go through the checklist with us?+
Yes. We can review your set-up against each point, write down what we find and give you a prioritised plan in plain English.