What a cybersecurity audit checks in a small business

The five areas we review

1. Backups. We check what is copied, how often and, above all, whether a copy has ever been restored. A backup that has never been tested is an assumption.
2. Access. Who gets into what, whether old accounts are still active and whether two-factor authentication is on where it matters: email, administration and cloud services.
3. Devices. Operating systems and programmes that are not updated, antivirus, and computers nobody manages any more.
4. Network. What is exposed to the outside, how the network is separated from the devices and which connected equipment nobody has inventoried.
5. Email. Filters, sender spoofing and the habit of opening attachments without checking. It is the most common way in.

What you get at the end

The result is a report with the risks ranked by importance. For each one it says what causes it and what it would cost to fix. The decision is yours, with the figures in front of you, and not a list of alarms.

Our audit costs €500 + VAT. The price is fixed and does not include the fixes: those are quoted separately once you know the report.

Audit or checklist: when each one

If you want to go through the basic controls yourself, our checklist guide is a good starting point. An audit makes sense when nobody has the time or the criteria to look at the system with some distance, or when you need to show a client or an external auditor that the system has been reviewed.

Either option is better than looking at nothing. The difference is how much time you save and how sure you want to be of the result.

After the audit

What is most useful after the report is a simple plan: first whatever can stop the business, then what exposes data, and finally the improvements. If you want to see the product in more detail, it is on our cybersecurity audit page.