The checklist
Every unchecked box is a door. Walk through it with whoever runs your IT.
Access
- A list exists of who can log into what, reviewed in the last quarter.
- MFA is on for all email, banking, and remote access. No exceptions ('except the owner' is the finding).
- Departing staff lose access the same day.
- No shared logins; where unavoidable, documented and vaulted.
- Day-to-day work happens in standard accounts, not admin accounts.
Passwords
- A password manager is deployed and actually used.
- No password does double duty across work and personal accounts.
- Default passwords changed on the router, firewall, and printers.
Updates
- Operating system updates install automatically.
- Browsers and everyday apps update automatically too.
- Anything end-of-life (Windows 10, old servers) is listed with a replacement date, not a shrug.
Backups
- Three copies, two media, one offsite or immutable (the 3-2-1 rule).
- A restore was actually tested in the last quarter. An untested backup is a hope.
- Backups can't be deleted with the same credentials attackers would steal from a desk.
Email
- SPF, DKIM, and DMARC records are set for your domain.
- External emails get a banner.
- Everyone knows exactly where to report a suspicious email.
The PDF adds:
- A printable one-pager for your next IT meeting
- The scoring guide: what your open boxes mean, in fix-first order