Checklist
Business Cybersecurity Checklist
Use these questions to review your current position and start conversations about priorities.
This checklist is general educational information. It is not a certified security audit, and completing it does not guarantee security. Your priorities depend on your specific environment and risks.
Accounts and access
- Multi-factor authentication is enabled for email, remote access, and administrator accounts.
- Each administrator uses an individual account.
- Access is removed promptly when employees or contractors leave.
- Privileged access is reviewed at least periodically.
Devices
- All business devices are inventoried and centrally managed.
- Operating systems and applications update automatically.
- Laptops and mobile devices use full-disk encryption.
- Users work with standard rather than administrator accounts.
Network
- Guest and IoT devices are separated from business systems.
- Firewall rules are documented and reviewed.
- Remote access requires multi-factor authentication.
- Default credentials have been changed on network equipment.
Cloud and SaaS
- Audit logging is enabled for key cloud services.
- Public sharing of storage and files is restricted.
- Unused accounts and access keys are removed.
- Security settings in key SaaS applications have been reviewed.
Data
- Sensitive data types and locations are known.
- Backups are stored separately and restores are tested.
- Retention periods are defined.
- Sensitive data is encrypted in transit and at rest.
People
- Employees know how to report suspicious messages.
- Payment changes are verified through a separate channel.
- Security awareness is refreshed regularly.
- Security responsibilities are clearly assigned.
Vendors
- Vendors with access to systems or data are listed.
- Vendor access is limited and reviewed.
- Security expectations are included in contracts where appropriate.
Incident readiness
- A written incident response plan exists.
- Emergency contacts are available offline.
- The plan has been exercised in the past year.
Request a Security Assessment
If the checklist raised questions, a structured assessment can provide a clearer picture of your environment.