A cybersecurity health check is not a scan. A scan tells you which software is out of date. A health check tells you which of your current arrangements would actually fail, and in what order, if someone phished a single member of staff on a Tuesday afternoon.
Below is the checklist we work through. You can run most of it yourself in an afternoon, and the answers will tell you where to spend first.
Identity and access, items 1 to 6
- Is multi factor authentication enforced for every account? Not available, not encouraged. Enforced, including for administrators and service accounts.
- Are administrator accounts separate from daily accounts? Nobody should read email from an account that can delete the tenant.
- How many global administrators exist? Count them. The usual answer is higher than it should be, and often includes a former contractor.
- Do leavers lose access the same day? Name the person responsible and show the last three leavers as evidence.
- Are shared logins in use anywhere? A shared account means an action can never be attributed to a person.
- Is there a password manager, and does anyone use it? Credentials in a spreadsheet or a browser profile are a finding, not a preference.
Email, items 7 to 10
- Are SPF, DKIM and DMARC configured and enforcing? Published but set to monitor only is half a control.
- Is inbound filtering catching impersonation, not just spam? The expensive attacks look like a message from your own director.
- Are mailbox forwarding rules monitored? A quiet rule forwarding everything to an outside address is a classic post compromise move.
- Do staff know how to report a suspicious email, and does anyone act on reports? A reporting button with nobody behind it is theatre.
Endpoints and patching, items 11 to 14
- Is every device accounted for? Compare your device list against your payroll. The gap is usually personal laptops holding company data.
- Is endpoint protection installed, reporting, and reviewed by a human? All three, not the first one.
- Are operating systems and third party applications patched on a schedule, with verification? Browsers and PDF readers matter as much as the operating system.
- Is disk encryption on across laptops? This is what makes a stolen laptop an inconvenience rather than a notifiable incident.
Backup and recovery, items 15 to 17
- When was the last successful restore, and how long did it take? A date and a duration, or the answer is no.
- Is one backup copy immutable and held under separate credentials? Otherwise a compromised administrator takes the backups too.
- Is email included in the backup scope? Frequently excluded, frequently the data that matters most in a dispute.
Network, process and people, items 18 to 20
- Is remote access controlled? No management interfaces exposed to the internet, remote access behind multi factor authentication, guest wifi separated from business systems.
- Is there a written incident response plan naming who is called first? One page is enough. Zero pages is the common state.
- Have staff had security awareness training in the last twelve months? People are the control that gets tested daily.
How to score it
Mark each item yes, partial or no. Then order the fixes by blast radius rather than by effort:
- Fix this week: any no on items 1, 2, 4, 15 or 16. These are the ones where a single compromised login turns into a business interruption.
- Fix this month: items 7, 9, 12, 13, 18.
- Plan this quarter: the rest, with training on a repeating schedule rather than once.
Most small businesses come out of this with four or five genuine gaps, and two of them are usually free to close. The value is not the score, it is the order.
When to bring someone in
Run it yourself first. Bring in help when you need evidence rather than opinion: a cyber insurance application, a client security questionnaire, a contract requirement, or a board that wants independent confirmation. Those situations need documentation with dates, which is the part that takes time rather than skill.
Our version of this, delivered as a documented report with a prioritised remediation list, is the cybersecurity health check. Ongoing coverage of the controls above sits under managed cybersecurity services, endpoint protection and email security and 2FA setup.