Cyber Security Audit Checklist for UK SMEs

Most small and mid-sized businesses do not fail an audit because of something exotic. They fail because of a handful of ordinary gaps: a shared admin account, an unpatched laptop, a mailbox rule nobody noticed, a backup nobody has restored from.

This checklist is the same structure we work through during a cyber security audit. You can use it as a self-assessment before bringing anyone in. Work through each section honestly, and mark each item green where you have evidence, amber where you think it is true but cannot prove it, and red where you know it is a gap. The ambers are usually the interesting part.

1. Identity and Access Control

Identity is the front door. If access is loose, every other control is working harder than it should.

• Multi-factor authentication is enforced by policy for every user, not just enabled and optional.
• Admin accounts are separate from day-to-day user accounts.
• There are no shared logins for business systems, and no generic accounts like "office" or "accounts".
• Leavers are disabled the same day they leave, and there is a record of it.
• Permissions have been reviewed in the last twelve months, with owners named.
• Legacy authentication and basic auth are blocked in Microsoft 365 or Google Workspace.

If you only fix one section, fix this one. MFA done properly is covered in more detail in our post on MFA that is actually enforced.

2. Devices and Endpoints

• You have a current list of every laptop, desktop, phone and tablet that touches business data.
• Operating systems and browsers are patched, and you can show patch status centrally rather than trusting each user.
• Disk encryption is on for all laptops.
• Endpoint protection is deployed everywhere and someone actually reads the alerts.
• Personal devices are either out of scope or covered by a stated policy.
• Unsupported operating systems are identified, with a replacement date.

3. Email Security

Email is still the most common way in, usually through business email compromise rather than dramatic malware.

• SPF, DKIM and DMARC are configured, and DMARC is doing more than monitoring.
• External sender warnings are switched on.
• Mailbox forwarding rules to external addresses are blocked or alerted on.
• Attachment and link protection is enabled on inbound mail.
• Staff know how to report a suspicious email, and reports are actually reviewed.
• Payment and bank detail changes require verification through a second channel.

4. Network and Infrastructure

• You know what is exposed to the internet: remote access, VPN, firewall management, published services.
• Firewall rules have been reviewed, and "temporary" rules from years ago have been removed.
• Remote access requires MFA, and RDP is not open to the internet.
• Guest Wi-Fi is separated from the business network.
• Network devices have unique admin passwords and current firmware.
• An external vulnerability scan has been run in the last six months, and the findings were actioned.

5. Data and Backups

• You know where personal and commercially sensitive data lives, including SaaS platforms.
• Backups cover cloud data such as Microsoft 365, not just servers.
• At least one copy is offline or otherwise out of reach of a compromised admin account.
• A restore has actually been tested, with a date you can point to.
• Retention periods are defined rather than "keep everything forever".

Our guide to a backup strategy for small businesses covers the restore testing side in more depth.

6. Suppliers and Third Parties

• You have a list of suppliers with access to your systems or data.
• You know what level of access your IT provider holds and how it is protected.
• Key SaaS platforms have been checked for security settings you own, such as MFA and admin roles.
• Contracts cover breach notification and data handling.

More on this in supply chain risk for SMEs.

7. Policy, People and Response

• There is a short, readable acceptable use and security policy staff have actually seen.
• Security awareness training happens more than once a year and reflects real threats.
• There is an incident response plan naming who does what, with out-of-hours contacts.
• You know your GDPR breach reporting obligations and the 72 hour clock.
• Someone at leadership level owns cyber risk and sees it reported regularly.

8. Evidence, Not Assumptions

The difference between a self-assessment and an audit is evidence. For each green item above, ask what you would show an assessor: a policy export, a configuration screenshot, a report, a ticket, a restore log. If the honest answer is "I would have to go and check", that item is amber, not green.

This is the same evidence discipline that underpins Cyber Essentials, ISO 27001 and customer due diligence questionnaires, which is why the checklist pays back well beyond a single audit. Our audit readiness checklist takes that further.

How to Prioritise What You Find

You will not fix everything at once, and you should not try. Order the work by two questions: how likely is this to be exploited, and how bad would it be if it were? In practice that usually puts identity, email and backups at the top for most SMEs, with policy and documentation lower down. A good audit report should do this ordering for you rather than handing over a flat list of findings.

Turning the Checklist Into a Plan

If you have worked through this and ended up with a lot of ambers, that is a normal and useful result. The next step is verification: checking whether the controls you believe exist are actually operating, and turning the gaps into a costed, prioritised plan.

Start with our free cyber health check for a quick view of where you stand, or read what a full cyber security audit includes if you want the findings validated independently.