Small Business IT Security Checklist

Accounts and access

Do you know who has administrator access? Have old employee and contractor accounts been removed? Is multi-factor authentication enabled for important accounts? Are administrator accounts separate from normal day-to-day accounts? Have guest users and external access been reviewed recently? Are users only given access to the systems and files they actually need?

Microsoft 365 and email

Is multi-factor authentication enforced across Microsoft 365? Are suspicious sign-ins and unusual account activity monitored? Are anti-phishing and anti-spam protections configured? Are SPF, DKIM and DMARC configured for your email domains? Have automatic email forwarding rules been checked? Is access to SharePoint, Teams and OneDrive reviewed regularly? Do you know which third-party applications have access to Microsoft 365?

Computers and devices

Do you have an up-to-date list of company laptops and computers? Are Windows, macOS and installed applications kept up to date? Is antivirus or endpoint protection installed and monitored? Are company devices encrypted? Can lost or stolen devices be disabled or wiped remotely? Are users prevented from installing software or making administrative changes unnecessarily? Are old or unsupported devices still being used?

Backups

Do you know exactly what is being backed up? Are backups taken often enough for the business? Is at least one copy protected from deletion or ransomware? Are backup administrator accounts properly protected? Have you successfully restored data from the backup recently? Does somebody receive an alert if a backup fails?

Recovery

Do you know what systems need to be restored first after an outage or attack? Are recovery instructions written down somewhere accessible? Do you know who needs to be contacted during an IT or security incident? Could the business continue operating if Microsoft 365, your server or your main line-of-business system was unavailable? Have you ever tested the recovery process?

How did you do?

If you answered No or Not sure to several of these questions, those are the areas worth looking at first.

This checklist is not a security audit, but it should give you a reasonable idea of where the obvious weaknesses are.

Check the basics of your IT security