Skip to content
Cyber Security Consultancy
Virtual CISO
Virtual Information Security Manager
ISO 27001 Consultation
NIST CSF Assessments
Cyber Essentials
Enterprise Security Architecture
Secure Software Architecture Development
Cloud Security Architecture Review
Managed Security
Vulnerability Scanning
Advanced Threat Hunting
Managed Detection and Response
Penetrating Testing
Cloud Penetration Testing
Training
Incident Response Training
User Awareness Training
Data Protection
Virtual DPO
GDPR Consultation
Resources
Assessments
Cyber Risk Assessment
GDPR Compliance Assessment
Blog
Events
Contact us
Assessments
Cyber Risk Assessment
SME Information Security Checklist
1. Access Control & User Management
*
Unique accounts for every user (no shared logins)
Multi-factor authentication (MFA) enabled for email, admin, and remote access
Remove/disable unused accounts immediately when staff leave
Limit admin privileges — only given when strictly needed
Strong password policy (min. 12 characters, complexity, no reuse)
(Cyber Essentials: User Access Control | ISO 27001: A.5 & A.6)
2. Device & Asset Security
*
Maintain an asset register (computers, mobiles, servers, software)
Encrypt all laptops, mobiles, and removable media
Ensure antivirus/anti-malware installed and up to date
Automatic screen lock enabled (e.g., 5–10 mins)
Apply security patches/updates regularly (automatic where possible)
(Cyber Essentials: Malware Protection, Secure Configuration | ISO 27001: A.5, A.8)
3. Network & System Security
*
Firewalls enabled on all internet-connected devices
Default passwords on routers, Wi-Fi, and equipment changed
Secure Wi-Fi (WPA3 or WPA2, strong password, hidden SSID optional)
Remote access via VPN or secure gateway
Segment guest Wi-Fi from business network
(Cyber Essentials: Firewalls & Secure Configuration | ISO 27001: A.5, A.8, A.10)
4. Data Protection & Backup
*
Identify sensitive data (customer, employee, financial)
Encrypt sensitive files in storage and transfer
Regular, automated backups taken and tested
Data retention policy in place (keep only what’s needed)
Procedures for secure disposal of old devices/media
(Cyber Essentials: Basic data controls | ISO 27001: A.5, A.8, A.12)
5. Policies & Awareness
*
Basic Information Security Policy communicated to staff
Staff trained on phishing, password hygiene, and reporting incidents
Remote working guidelines in place (VPN, no personal device use unless approved)
Clear desk/clear screen policy (avoid leaving data exposed)
Regular refresher training (at least annually)
(ISO 27001: A.5, A.6, A.7)
6. Monitoring & Incident Management
*
Log security events (e.g., failed logins, suspicious activity)
Incident response plan in place (who to call, what steps to follow)
Know reporting obligations (e.g., ICO for personal data breaches in UK)
Test incident response at least once per year
Review logs and security alerts regularly
(Cyber Essentials Plus requires monitoring | ISO 27001: A.5, A.8, A.16)
7. Supplier & Third-Party Risk
*
Maintain a list of key suppliers (IT, cloud, payment providers)
Check suppliers follow security best practices (Cyber Essentials, ISO 27001, SOC 2)
Contracts include confidentiality and data protection clauses
Regularly review supplier security performance
(ISO 27001: A.5, A.15)
8. Continuous Improvement
*
Review security policies annually
Conduct at least one internal security review or audit per year
Apply lessons learned from incidents or near misses
Consider Cyber Essentials / ISO 27001 certification for assurance
(ISO 27001: Continuous Improvement, PDCA cycle)
Basic Info
First Name
*
Last Name
*
Email Address
*
Company Name
*
Submit
