IT Security Audit Checklist for Small Businesses

A small-business IT security audit is a structured review of how you protect accounts, devices, data, networks and people, followed by a ranked list of fixes. The core areas to check are: who has access to what, whether multi-factor authentication is on, whether devices and software are patched, how email is protected, whether backups are tested, how your network and cloud settings are configured, what data you hold and where, and whether anyone knows what to do in an incident. This checklist walks through each area so you can work through it in a few hours or hand it to a provider.

Before you begin: scope and inventory

You cannot protect what you do not know you have. Start with a plain inventory:

• People: staff, contractors, former staff who may still have access.
• Devices: laptops, desktops, phones, tablets, printers, servers and network equipment.
• Software and services: email, file storage, accounting, CRM, line-of-business apps, cloud platforms, website and domain registrar.
• Data: customer records, financial data, staff data, intellectual property, and where each is stored.

Mark the items whose loss or exposure would hurt most. Those get checked first.

1. Accounts and access

• Every person has their own account. No shared logins for systems that hold sensitive data.
• Multi-factor authentication (MFA) is on for email, cloud services, remote access and all administrator accounts.
• Passwords are unique per service, and a password manager is available to staff.
• Administrator rights are limited to the people who need them, and admins use separate accounts for day-to-day work.
• Leavers lose access the same day. Check for old accounts still active.
• Access is reviewed at least annually: does each person still need what they have?
• Default and vendor passwords on devices and applications have been changed.

2. Devices and endpoints

• Devices are listed, owned and assigned to a person.
• Operating systems are supported and receive updates. Unsupported systems are replaced or isolated.
• Disk encryption is enabled on laptops and mobile devices.
• Endpoint protection is installed, running and updating.
• Screen locks with a short timeout are enforced.
• A process exists for lost or stolen devices, including remote lock or wipe where available.
• Personal devices used for work have clear rules for what they may access.

3. Patching and software

• Operating system and application updates are applied on a defined schedule.
• Critical security updates are applied faster than routine ones, with a stated target your team can meet.
• Browsers, plug-ins and remote-access tools are included, not only the operating system.
• Network devices such as routers and firewalls have current firmware.
• Software that nobody uses has been removed.
• Website platforms, plug-ins and themes are updated.

4. Email and phishing

Email is a common entry point, so it deserves its own check.

• Spam and malware filtering is active.
• Email authentication records (SPF, DKIM and DMARC) are configured for your domain, which helps prevent others spoofing your address.
• Staff know how to spot and report suspicious messages, and there is an easy way to report them.
• Payment-change requests are verified by a second channel, such as a phone call to a known number.
• Automatic forwarding rules to external addresses are reviewed, as attackers sometimes create them.

5. Network and remote access

• A firewall protects the office network and its rules are reviewed.
• Wi-Fi uses strong encryption and a strong passphrase, and guest Wi-Fi is separate from the business network.
• Remote access uses a VPN or a modern secure access method with MFA, and not an open remote desktop port exposed to the internet.
• Unused ports and services are closed.
• You know which devices are connected to your network.

6. Cloud and website

• Cloud admin consoles require MFA and have few administrators.
• Storage buckets, shared folders and shared links are not publicly open by accident.
• Sharing settings are reviewed and old links expired.
• The domain registration and DNS accounts are protected with MFA and renewal is monitored.
• Your website uses HTTPS, and forms, login pages and admin panels are protected.
• Third-party integrations and apps with access to your data are listed and still needed. Our API integration best practices cover safe handling of keys and permissions.

7. Data protection and privacy

• You know what personal data you hold, why, and where it is stored.
• Access to sensitive data is limited to those who need it.
• Data is kept only as long as required, and old data is disposed of securely.
• Data processing arrangements with suppliers are in place where required.
• You know how to recognise and report a personal data breach within the timescales applicable to your business. Take your own legal advice on GDPR obligations; this checklist is general guidance, not legal advice.

8. Backups and recovery

• Critical data and systems are backed up automatically.
• At least one copy is separate from your main environment, and protected so that malware or a compromised account cannot erase it.
• Backup success and failure alerts go to a person who reads them.
• Restores are tested on a schedule, and the results recorded. This is where many plans fail; read why untested backups fail.
• You know how long recovery would take and what you could lose, and the business accepts that.

9. Policies, people and incident readiness

• A short, plain-language acceptable-use and security policy exists, and staff have read it.
• New staff receive security guidance, and everyone gets a refresher regularly.
• A written incident plan names who to call, how to isolate affected devices, who contacts customers and who decides about reporting.
• Key contacts are stored somewhere that remains available if email is down.
• Cyber insurance, if you have it, is understood: what it covers, what it requires and who to notify.
• You have a record of systems and credentials that someone senior can reach in an emergency.

Scoring and prioritising your findings

Once you have gone through the list, record each gap with a simple rating. This is a prioritisation aid, not a formal risk score.

Priority	Meaning	Example
High	Easy for an attacker and serious if exploited; fix now	No MFA on email; unsupported server exposed to the internet
Medium	Meaningful weakness that needs a plan within a few months	No tested restore; shared logins on a finance system
Low	Housekeeping and improvement	Old software still installed; policy wording out of date

For each item, record the owner, the action and a target date. Review progress monthly until the high items are closed.

A worked example of the output

Imagine a hypothetical 12-person office. Its audit finds that MFA is on for email but not for the accounting software, two former contractors still have file access, laptops are not encrypted, and backups run nightly but nobody has tried restoring from them. The resulting plan might be: this week, enable MFA on accounting and remove the two accounts; this month, turn on disk encryption and test one restore; this quarter, write a one-page incident plan and run a phishing awareness session. It is an illustration, not a real client story.

Common mistakes

• Treating the audit as a one-off. Security drifts as people and systems change.
• A long report and no action. Fewer, ranked fixes with owners work better.
• Buying tools before basics. MFA, updates and backups beat an expensive product on a neglected network.
• Forgetting suppliers. Your data may be only as safe as your weakest third party.
• Ignoring people. Staff awareness and a simple way to report mistakes matter as much as software.
• Not checking leavers and contractors. Old accounts are a quiet risk.
• Believing "we are too small to be a target". Automated attacks do not choose by size.

Standards and references

If you want a recognised framework to work against, look at the guidance published by Ireland's National Cyber Security Centre, the UK NCSC's Cyber Essentials requirements (often used as a baseline by small businesses), and the OWASP resources for web applications. Use them as a reference for what good looks like, and confirm any certification requirements directly with the issuing body.

Getting an independent view

A checklist finds the common gaps. An independent review adds technical testing, configuration checks you may not know to make, and a clear, ranked remediation plan. CloudWiss provides managed IT and support services that include security audits, system maintenance and ongoing infrastructure management, so findings can be turned into fixes and kept under review. Our guide on what managed IT services include explains how that support typically works.