# Cyber Security Checklist — No Security Team

**Organisation:** _______________  **Date:** _______  **Completed by:** _______________

> Ranked by **protection per unit of effort**, not by framework section number. Sections 1–2 stop
> most of what actually happens. Do those before anything else.

## 1. The six that do most of the work

- [ ] **Multi-factor authentication on email** — do this first. Email resets every other password
- [ ] MFA on all financial systems
- [ ] MFA everywhere else it is offered
- [ ] **Automatic updates enabled** where you can tolerate them
- [ ] A written list of every system you run, who owns it, where updates come from
- [ ] **Backups: 3 copies, 2 media, 1 offline or immutable**
- [ ] A real restore tested in the last quarter — not a "backup job succeeded" message
- [ ] Least privilege — nobody is an administrator by default
- [ ] **Leaver access removed same-day**
- [ ] **Payment detail changes verified out of band** — phone the number you already had, never the one in the email

## 2. Accounts

- [ ] No shared accounts — every action attributable to a person
- [ ] Password manager provided and used
- [ ] Default credentials changed on every device and service
- [ ] Access reviewed in the last quarter
- [ ] Dormant accounts disabled
- [ ] Administrative work done from a separate account, not the one used for email

## 3. Devices

- [ ] Disk encryption on laptops and phones
- [ ] Screen lock enforced
- [ ] Remote wipe available
- [ ] Endpoint protection installed and reporting
- [ ] Personal devices with company data covered by *something*

## 4. Data

- [ ] You know what personal data you hold and where
- [ ] Not stored where it does not need to be
- [ ] Encrypted in transit — TLS everywhere
- [ ] Retention period defined and actually enforced
- [ ] Test environments do not contain real personal data

## 5. Suppliers

- [ ] List of suppliers holding your data
- [ ] What each holds, recorded
- [ ] Their breach notification obligation to you, known
- [ ] Contractor access removed when engagements end

## 6. AI-specific surface

- [ ] **Approved AI tool provided** whose terms exclude training on your data
- [ ] Staff told which tool, and what may not be pasted into it
- [ ] If you built anything with a model: it cannot reach systems beyond its declared tools
- [ ] Destructive or outbound actions require human approval
- [ ] **Prompt injection considered** — what happens if retrieved content contains instructions?
- [ ] No component holds both broad read and broad write access
- [ ] **AI disclosure in place** — EU AI Act Art. 50 has applied since 2 Aug 2026
- [ ] Deepfake / voice authorisation defended by out-of-band verification, not by recognising a voice

## 7. People

- [ ] Training focuses on **process, not spotting bad English** — AI phishing is fluent
- [ ] Everyone knows how to report a suspected phishing message
- [ ] Reporting is rewarded, never punished
- [ ] Everyone knows that urgency is itself a warning sign

## 8. If something goes wrong

- [ ] **One named person** with authority to disconnect systems and spend money
- [ ] A named deputy
- [ ] Fallback communication channel agreed, if email is compromised
- [ ] Contact list stored **offline** — insurer, legal, IT provider
- [ ] Regulatory notification window known **before** the clock starts
- [ ] Rule agreed: preserve evidence before rebuilding

## Sign-off

| | Name | Date |
|---|---|---|
| Completed by | | |
| Reviewed by | | |

**Accepted risks:**

| # | Not met | Why accepted | Revisit by |
|---|---|---|---|
| | | | |