Free security checklist

Review the basics before small gaps become bigger problems.

This practical checklist is designed for small-business owners and managers who want a clearer view of common network-security risks.

Start with the $497 checkup

Firewall rules and remote access

The firewall has a named owner and a recent review date
Old or temporary rules have been removed
Unnecessary internet-facing ports are closed
Vendor access is documented and limited
VPN access uses individual accounts and multifactor authentication
A current firewall configuration backup exists

Warning sign: If no one can explain what the firewall rules do, it is time for a review.

Business and guest Wi-Fi

Guest Wi-Fi is isolated from staff and business devices
Modern WPA2 or WPA3 encryption is enabled
Former staff and vendors no longer know active credentials
Access-point administration is limited and documented
Business, guest and connected-device traffic are segmented appropriately

Warning sign: Guest devices should never have unnecessary access to business systems.

Accounts and administrative access

Administrative accounts are separate from everyday accounts
Former employee accounts are disabled promptly
Shared administrative passwords are avoided
Multifactor authentication protects important systems
Vendor accounts are reviewed regularly

Warning sign: When everyone has administrator rights, the business is harder to protect and recover.

Endpoint protection and updates

Business devices receive supported security updates
Endpoint protection is active and monitored
Unsupported operating systems are identified
A current inventory of connected devices exists
Lost or stolen devices are covered by a response plan

Warning sign: Unknown and unsupported devices create risk that cannot be managed well.

Backups and recovery

Critical business data is included
Backups are stored separately from primary systems
Cloud-backup access is strongly protected
A representative restore has been tested
Recovery ownership and timing are documented

Warning sign: A scheduled backup is not a recovery plan until a restore has been tested.

Documentation and vendor access

A basic network diagram is current
Key devices, providers and support contacts are listed
Firewall rules, networks and important addresses are documented
Vendor access is limited, reviewed and removable
Important credentials are stored securely

Warning sign: If network knowledge exists only in one person’s head, the business has operational risk.

Need help reviewing your network?

Turn the checklist into a prioritized action plan.

Send project details