An SME does not need to begin with a collection of tools. It needs to understand what it protects, what could fail and which controls reduce operational risk first.
This checklist turns that review into verifiable decisions. It is not a replacement for a technical audit, but it can reveal unprotected accounts, untested backups and devices excluded from maintenance.
Assign an owner and evidence to every item. A tick only means something when the control can be demonstrated and reviewed as people, suppliers and systems change.
How to use the checklist without creating paperwork
Bring together the people who understand the systems and those responsible for business continuity. Record status, owner, evidence and the next review date for every control.
- Critical: its absence could stop operations or enable broad access; address it first.
- Important: it reduces exposure or speeds recovery; schedule it with a firm date.
- Improvement: it adds maturity but must not displace an overdue basic control.
A written policy is not an operational control. Ask for evidence: a completed restore, an account list or an update log.
High priority: identity, recovery and updates
1. Protect accounts and access
Email, cloud administration and management applications often provide access to many processes and data sets. Identity needs proportionate protection.
- Enable multi-factor authentication, starting with administrators, email, banking and cloud services.
- Use individual accounts and remove or block access for people who no longer work with the business.
- Prevent password reuse and manage credentials with a suitable tool.
2. Keep backups you can recover
A backup protects the business only when it contains the required data, remains isolated from an incident and can be restored within an acceptable timeframe.
- Define the data, configurations and applications that operations depend on.
- Automate backups and keep at least one copy separate from the normal environment.
- Test restores regularly and record duration, errors and ownership.
3. Control outdated devices and software
Updates reduce exposure to known vulnerabilities, but an inventory and sound change process are needed to avoid disrupting critical systems.
- Cover computers, mobiles, servers, routers, applications, plugins and connected devices.
- Prioritise exploited vulnerabilities and internet-facing systems or those holding sensitive data.
- Retire or isolate unsupported products and test sensitive changes before deployment.
Controls that sustain security day to day
4. Maintain a useful inventory
Record devices, applications, important data, owners and suppliers. An unknown asset cannot be handled reliably when it fails or is compromised.
5. Restrict permissions and exposure
Grant only necessary access, separate administrative accounts from daily-use accounts and review shared permissions. Segment networks when guest, production or connected devices should not communicate.
6. Prepare staff for social engineering
Training should mirror real situations: fake invoices, changed bank details, credential recovery and urgent executive requests. Verify sensitive payments and changes through a known second channel.
7. Decide what to do before an incident
A short, rehearsed plan is more useful than a long manual nobody can find. It should establish who coordinates, how damage is contained and how operations continue.
- List internal contacts, technical suppliers, legal support and alternative channels.
- Define how to isolate devices and preserve information without destroying evidence.
- Document escalation, communication and recovery criteria, then rehearse a simple scenario.
Turn the list into a 30, 60 and 90-day plan
Do not try to close every item at once. Rank actions by impact, exposure and business dependency.
- First 30 days: MFA on critical accounts, user offboarding, verified backups and urgent patches.
- By 60 days: inventory, permissions, suppliers, endpoint protection and practical training.
- By 90 days: incident plan, restore exercise, and network and application review.
- Ongoing: regular reviews, simple metrics and reassessment after every significant change.
If internal resources cannot validate technical configuration or risk, a professional review of cybersecurity for businesses.
Turn findings into verifiable improvements
Efiprox can help review your environment, prioritise risks and implement controls suited to your actual systems and processes.
Consideration stage
Compare options and choose the next step with clarity
If you are already evaluating solutions, we can help you prioritize impact, timelines, and fit with your real processes.
Frequently asked questions
Where should an SME start?
Start with critical accounts, recoverable backups and urgent updates. Then complete the inventory, permissions, training and incident response work.
How often should the checklist be reviewed?
Critical controls need continuous oversight and the full set should be reviewed regularly, as well as after staff changes, new suppliers, migrations or incidents.
Is antivirus enough?
No. It is one layer and does not replace MFA, updates, tested backups, least privilege, staff awareness or an incident plan.
How do I know whether a backup works?
Restore a sample in a controlled environment and check integrity, duration and required steps. Document the result.
When is specialist support needed?
Seek support when internal staff cannot validate configurations, systems are critical or exposed, sensitive data is handled, or findings cannot be prioritised confidently.
