Cyber Security Audit Checklist for Small Businesses (One-Day DIY Review)

Big companies hire auditors. Small businesses can still do a useful self-review in a day. Use this cyber security audit checklist once a year (or after any incident) and fix the "No" answers in order of risk.

1. Accounts and passwords

• [ ] Every critical account (email, bank, domain, hosting, social media) has 2FA
• [ ] A password manager is used; no shared spreadsheets of passwords
• [ ] No former staff or agencies still have access. See offboarding checklist
• [ ] Admin rights are limited to people who need them

2. Devices

• [ ] All computers run supported, updated operating systems
• [ ] Antivirus/endpoint protection is active. See endpoint security
• [ ] Disk encryption on laptops
• [ ] No pirated software

3. Network

• [ ] Router admin password changed from default; firmware updated
• [ ] Separate guest Wi-Fi
• [ ] CCTV DVR/NVR not exposed to the internet with default passwords
• [ ] Remote access (RDP/AnyDesk) secured or disabled

4. Website

• [ ] HTTPS everywhere. See SSL guide
• [ ] CMS, plugins and PHP updated. See WordPress security checklist
• [ ] Forms protected from spam and injection. See PHP security
• [ ] Domain in the business's name with auto-renew
• [ ] Firewall/CDN in front. See WAF explained

5. Email

• [ ] SPF, DKIM and DMARC set. See email spoofing
• [ ] Staff know how to spot phishing. See phishing signs

6. Backups

• [ ] 3-2-1 backups for office data and the website
• [ ] A restore was tested in the last 6 months

7. People and process

• [ ] A rule to verify bank detail changes by phone. See business email compromise
• [ ] Short security awareness session in the last year
• [ ] A written list of who to call in an incident (IT support, bank, 1930, host)

8. Data protection

• [ ] Privacy policy matches what you collect. See privacy policy guide
• [ ] Customer data access limited and deleted when no longer needed

Prioritise

Fix in this order: 2FA and passwords → backups → updates → email security → everything else. For deeper testing, consider VAPT.

FAQs

How long does this take?

A few hours to a day for a small office with one website.

Should an outsider do it?

An external review adds objectivity, especially for websites handling payments or sensitive data.