Basic Security Audit Checklist
This checklist helps a small business, shop or home office check its basic cyber security in an afternoon. It covers devices, accounts, passwords, updates, backups, Wi-Fi, email, the website and what to do if something goes wrong. No specialist tools are needed. Work through each section, mark items as done, partly done or missing, then fix the missing items starting with MFA, backups and updates. Repeat the audit every six to twelve months.
How to use this checklist
- List what you have. Start with the asset inventory so you know every device, account and service you need to protect.
- Mark each item. Note whether each item is done, partly done or missing, and who is responsible.
- Fix the high-impact gaps first. MFA on email and banking, working backups and automatic updates prevent the most common losses.
- Repeat regularly. Run the audit again every six to twelve months and whenever staff, devices or services change.
0 of 46 checked
Asset inventory
Accounts, MFA and passwords
Devices, patching and endpoint protection
Backups
Network and Wi-Fi
Email security
Website and online services
Logging and incident response
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy off-site. Keeping one copy offline as well protects against ransomware.
What are SPF, DKIM and DMARC?
They are DNS-based email authentication standards. SPF lists who may send for your domain, DKIM adds a signature to messages and DMARC tells receivers what to do when checks fail.
Does a small business need to report incidents to CERT-In?
CERT-In's 2022 directions apply to service providers, intermediaries, data centres, body corporates and government organisations, which can include small companies. If in doubt, read the directions on cert-in.org.in or ask a legal adviser.
What is the single most important step?
Turning on multi-factor authentication for email and banking, together with tested backups, prevents a large share of common losses.