Security Audit Checklist for Small Businesses

You don’t need an expensive consultant to assess your security. This checklist helps small businesses identify and address common vulnerabilities.

How to Use This Checklist

Rate each item:

• ✅ Implemented - Fully in place
• 🔶 Partial - Some progress, needs improvement
• ❌ Not Done - Not implemented
• ⏭️ Not Applicable - Doesn’t apply to your business

Focus on fixing ❌ items first, then improving 🔶 items.

Section 1: Access Control

User Accounts

• Every employee has individual accounts (no shared logins)
• Account access is revoked immediately when employees leave
• Admin access is limited to those who need it
• Access rights are reviewed quarterly
• Guest/temporary accounts have expiration dates

Passwords

• Password manager is used across the organization
• Minimum password requirements are enforced
• Password reuse is prevented (or strongly discouraged)
• Shared accounts use unique, strong passwords
• Service account passwords are managed securely

Two-Factor Authentication

• 2FA is enabled on all critical systems
• 2FA is required for email accounts
• 2FA is required for cloud services
• 2FA is required for financial systems
• 2FA backup methods are configured

Section 2: Device Security

Computers

• All devices have strong passwords/PINs
• Full disk encryption is enabled
• Automatic screen lock is configured
• Operating systems are kept updated
• Antivirus/antimalware is installed and updated
• Firewall is enabled

Mobile Devices

• Device encryption is enabled
• Remote wipe capability is configured
• Biometric authentication is enabled
• OS and apps are kept updated
• Only approved apps are installed

Physical Security

• Devices are secured when unattended
• Server/network equipment is in locked areas
• Visitors don’t have unsupervised access
• Sensitive documents are secured
• Clean desk policy is followed

Section 3: Network Security

Wi-Fi

• Strong Wi-Fi password (WPA2/WPA3)
• Default router credentials changed
• Guest network separated from business network
• Router firmware is updated
• WPS is disabled

Internet Security

• Business firewall is in place
• VPN is available for remote work
• VPN is required for sensitive access
• DNS filtering is considered

Remote Access

• Remote access requires 2FA
• Remote sessions timeout automatically
• Remote access is logged
• Unused remote access is disabled

Section 4: Data Protection

Data Classification

• Data is classified by sensitivity
• Handling procedures exist for each level
• Team knows how to classify data
• Most sensitive data is identified

Storage

• Sensitive data is encrypted at rest
• Cloud storage is from approved providers
• Personal cloud accounts aren’t used for work
• Backup encryption is enabled
• Data residency requirements are met

Sharing

• Secure methods exist for sensitive file sharing
• Email attachments are avoided for sensitive data
• Sharing permissions are reviewed regularly
• External sharing is tracked

Retention & Disposal

• Data retention policy exists
• Old data is deleted per policy
• Hard drives are securely wiped before disposal
• Paper documents are shredded

Section 5: Email Security

Configuration

• Business email (not personal) is used for work
• Email encryption is available (TLS at minimum)
• Spam filtering is enabled
• Phishing protection is active
• DMARC/SPF/DKIM are configured

User Practices

• Team can identify phishing attempts
• Suspicious emails are reported
• Links are verified before clicking
• Attachments from unknown senders are treated with caution

Section 6: Software & Updates

Patch Management

• Operating systems are updated promptly
• Business software is kept current
• Browser plugins are updated
• Update process is documented
• Legacy software is identified and risk-assessed

Software Control

• Only approved software is installed
• Software inventory is maintained
• Unauthorized software is detected
• License compliance is managed

Section 7: Backup & Recovery

Backups

• Critical data is backed up regularly
• Backups are encrypted
• Backup recovery is tested periodically
• Backups are stored offsite/in cloud
• Backup status is monitored

Disaster Recovery

• Critical systems are identified
• Recovery time objectives are defined
• Recovery procedures are documented
• Recovery has been tested

Section 8: Security Awareness

Training

• New employees receive security training
• Training is repeated annually
• Phishing simulations are conducted
• Training is updated for new threats

Policies

• Security policy exists and is documented
• Acceptable use policy exists
• Password policy exists
• Policies are accessible to all employees
• Policies are reviewed annually

Section 9: Incident Response

Preparation

• Incident response plan exists
• Contact list for incidents is maintained
• Team knows how to report incidents
• Insurance coverage is reviewed

Response Capability

• Security events are logged
• Logs are reviewed periodically
• Unusual activity alerts are configured
• Incident response has been practiced

Section 10: Vendor & Third Party

Vendor Assessment

• Critical vendors are identified
• Vendor security is evaluated
• Contracts include security requirements
• Vendor access is limited and monitored

Third-Party Services

• Cloud service security is assessed
• Data processing agreements are in place
• Third-party access is reviewed regularly
• Unused integrations are disabled

Scoring Your Audit

Count your responses:

Score	Rating	Action
80%+ ✅	Strong	Maintain and improve
60-79%	Moderate	Address gaps systematically
40-59%	Needs Work	Prioritize critical items
Under 40%	At Risk	Immediate action needed

Creating an Action Plan

When to Get Professional Help

Consider hiring a security professional if:

• You handle highly sensitive data (healthcare, financial)
• Compliance requirements mandate audits
• You’ve experienced a security incident
• Your checklist score is below 50%
• You’re unsure how to implement improvements

A DIY audit is a great start. It helps you understand your security posture and have informed conversations with professionals when you need them.

Conclusion

This checklist isn’t exhaustive, but it covers the fundamentals. Regular self-assessment helps you:

• Identify vulnerabilities before attackers do
• Prioritize security investments
• Track improvement over time
• Demonstrate due diligence

Run through this checklist quarterly, updating your action plan each time. Security is an ongoing process, not a one-time project.