Accounts & access

Multi-factor authentication is on for email and admin accountsThe single most effective protection against stolen passwords. Every person has their own account; no shared loginsShared accounts make it impossible to see who did what. Leavers’ accounts are disabled the same day they leaveOld accounts are a common way in. Staff use a password manager or long passphrasesReused or weak passwords are guessed quickly. Admin rights are limited to the people who need themLeast privilege limits the damage from one mistake.

Devices & software

Operating systems and apps are updated regularlyMost attacks use known flaws that already have fixes. Antivirus / endpoint protection is active on every computerBasic protection against malware and ransomware. Laptops and phones are encrypted and can be wiped if lostA lost device should not be a data breach. You keep an up-to-date list of devices and software licencesYou cannot protect what you do not know you have.

Network & internet

Wi-Fi uses strong encryption and a private passwordGuest and staff networks should be separate. A firewall controls what enters and leaves your networkYour first line of defence at the edge. Default passwords on routers and cameras have been changedDefaults are published online and tried by attackers. Remote access is secured with VPN or similar, not left openExposed remote desktop is a top ransomware entry point.

Data & backups

Important data is backed up automaticallyBackups turn a disaster into an inconvenience. At least one backup copy is stored off-site or offlineRansomware encrypts connected backups too. You have tested restoring from a backup in the last yearUntested backups often fail when needed. Sensitive data is only accessible to those who need itReduces exposure if an account is compromised.

People & process

Staff have had security awareness training this yearPhishing succeeds because people are rushed, not careless. There is a clear way to report suspicious emails or incidentsFast reporting limits the damage. You have a written incident response and contact planWho does what, and who to call, decided in advance.

Physical security

Server and network equipment is in a locked, ventilated spacePhysical access is full access. Entrances are covered by CCTV or access controlDeters theft and gives you evidence. Equipment is protected from power surges (UPS / surge protection)Essential for island power conditions.

More tools

Try another tool

Turn your result into a plan.

Share your results with our team and we will recommend practical, prioritised next steps.

Talk to us

Cybersecurity Checklist