Cyber Security Checklist for SMEs
A practical checklist to help your business review passwords, multi-factor authentication, backups and staff awareness. Use it to identify simple improvements that can reduce your exposure to common cyber threats.
- Estimated time: 5–10 minutes
Why cyber security matters for SMEs
Small and medium-sized businesses can be targeted through phishing emails, stolen passwords, ransomware, insecure devices and unpatched software. This checklist provides a straightforward way to review some of the most important cyber security controls in your organisation. It is written for business owners and decision-makers, not technical specialists.
Please Note
SECURITY POSTURE REPORT
Your Cyber Security Checklist
Review each item and mark the controls your business already has in place. Any unchecked item should be discussed with your internal IT team or managed service provider.
PASSWORDS AND ACCOUNT SECURITY
- Unique, complex passwords are used across all corporate profiles.
- Minimum password length of 14 characters is enforced company-wide.
- An enterprise-grade password manager is officially deployed to all users.
- Default manufacturer credentials are changed immediately on network devices.
- Lockout policies trigger automatically after 5 consecutive failed login attempts.
- Idle workstations automatically log out after 15 minutes of inactivity.
- Corporate access credentials are kept strictly separated from personal use.
- No passwords are written down, shared over email, or sent via unsecure chat.
VALIANT RECOMMENDATION
Standardise on Password Vaults
Implementing a centralised business credential vault completely removes human memory from the equation, giving managers strict enforcement tools and deep visibility.
MULTI-FACTOR AUTHENTICATION
- MFA is strictly enforced for all primary business and email environments.
- MFA is mandated across all active remote access pathways (VPNs and RDP).
- Accounting, finance software, and payment portals are secured behind MFA.
- Domain and privileged administrative identities require MFA validation.
- Push alerts or time-based OTP applications are utilized instead of SMS codes.
- Hardware key mechanisms (YubiKeys) protect administrative and key security roles.
- Unscheduled or suspicious bypass prompts alert network security personnel.
- Staff undergo coaching to never approve uninitiated authentication alerts.
VALIANT RECOMMENDATION
Eradicate SMS-Based MFA
DATA BACKUPS AND RECOVERY
- Crucial corporate databases are automatically backed up on a daily schedule.
- A redundant backup is isolated entirely offline or in immutable cloud vaults.
- The standard 3-2-1 backup strategy is properly implemented and maintained.
- Backup infrastructure functions separately from primary domain environments.
- Full recovery drills and restore validations occur on a regular quarterly basis.
- Active backup mechanisms protect key SaaS data like Office 365 or G Suite.
- Server images are maintained to achieve minimized recovery time objectives.
- Write-Once-Read-Many (WORM) parameters lock archival data from changes.
- System logs undergo automated verification reviews to identify backup failure alerts.
- Backup encryption credentials are key-locked and located separately.
VALIANT RECOMMENDATION
Mandate Immutability
STAFF AWARENESS AND PHISHING
- All new hires receive core security training onboarding procedures.
- Company-wide information security reviews repeat on an annual schedule.
- Simulated phishing campaigns are initiated monthly to test staff alertness.
- Employees utilise a standardized, quick protocol to report threat emails.
- Financial and payroll departments have distinct training for spear-phishing scams.
- Executive leadership receives dedicated briefs on high-target social engineering.
- Inbound external emails automatically carry warning tags in header rows.
- Alert summaries containing active cyber trends are regularly distributed.
- Workspace clear-desk policies mandate locked screens and secure physical papers.
- Immediate remediation training is assigned to users who fail phishing simulations.
VALIANT RECOMMENDATION
Build a Human Firewall
How did your business perform?
GOOD FOUNDATION
IMPROVEMENTS NEEDED
URGENT REVIEW RECOMMENDED
This checklist is an initial self-assessment and does not confirm that an organisation is fully secure.
Four actions to prioritise
Strengthen passwords
Use unique passwords, an approved password manager and tightly controlled administrator access.
Enable MFA
Verify your backups
Train your employees
Would you like help reviewing your cyber security?
Valiant Systems Group can help identify practical improvements and protect your organisation through managed IT support and cyber security services.
VSG delivers dependable IT and security services designed for real-world businesses. We reduce risk, improve performance, and give you peace of mind with support you can trust.
Registered in the United Kingdom and Wales
Company Number: 16072925
D-U-N-S Number: 232653775