Checklist · Cyber Security

Cyber Security Checklist for Organisations Without a Security Team

The controls that stop most real attacks, ranked by protection per unit of effort, plus the AI-specific surface. Written for organisations where one person also does IT.

Download the checklist (Word) Read the full guide

Markdown. No sign-up, no email.

Organisation: _______________ Date: _______ Completed by: _______________

Ranked by protection per unit of effort, not by framework section number. Sections 1 to 2 stop most of what actually happens. Do those before anything else.

1. The six that do most of the work#

[ ] Multi-factor authentication on email. Do this first. Email resets every other password
[ ] MFA on all financial systems
[ ] MFA everywhere else it is offered
[ ] Automatic updates enabled where you can tolerate them
[ ] A written list of every system you run, who owns it, where updates come from
[ ] Backups: 3 copies, 2 media, 1 offline or immutable
[ ] A real restore tested in the last quarter, not a "backup job succeeded" message
[ ] Least privilege, nobody is an administrator by default
[ ] Leaver access removed same-day
[ ] Payment detail changes verified out of band. Phone the number you already had, never the one in the email

2. Accounts#

[ ] No shared accounts, every action attributable to a person
[ ] Password manager provided and used
[ ] Default credentials changed on every device and service
[ ] Access reviewed in the last quarter
[ ] Dormant accounts disabled
[ ] Administrative work done from a separate account, not the one used for email

3. Devices#

[ ] Disk encryption on laptops and phones
[ ] Screen lock enforced
[ ] Remote wipe available
[ ] Endpoint protection installed and reporting
[ ] Personal devices with company data covered by something

4. Data#

[ ] You know what personal data you hold and where
[ ] Not stored where it does not need to be
[ ] Encrypted in transit, TLS everywhere
[ ] Retention period defined and actually enforced
[ ] Test environments do not contain real personal data

5. Suppliers#

[ ] List of suppliers holding your data
[ ] What each holds, recorded
[ ] Their breach notification obligation to you, known
[ ] Contractor access removed when engagements end

6. AI-specific surface#

[ ] Approved AI tool provided whose terms exclude training on your data
[ ] Staff told which tool, and what may not be pasted into it
[ ] If you built anything with a model: it cannot reach systems beyond its declared tools
[ ] Destructive or outbound actions require human approval
[ ] Prompt injection considered. What happens if retrieved content contains instructions?
[ ] No component holds both broad read and broad write access
[ ] AI disclosure in place. EU AI Act Art. 50 has applied since 2 Aug 2026
[ ] Deepfake / voice authorisation defended by out-of-band verification, not by recognising a voice

7. People#

[ ] Training focuses on process, not spotting bad English. AI phishing is fluent
[ ] Everyone knows how to report a suspected phishing message
[ ] Reporting is rewarded, never punished
[ ] Everyone knows that urgency is itself a warning sign

8. If something goes wrong#

[ ] One named person with authority to disconnect systems and spend money
[ ] A named deputy
[ ] Fallback communication channel agreed, if email is compromised
[ ] Contact list stored offline. Insurer, legal, IT provider
[ ] Regulatory notification window known before the clock starts
[ ] Rule agreed: preserve evidence before rebuilding

Sign-off#

	Name	Date
Completed by
Reviewed by

Accepted risks:

#	Not met	Why accepted	Revisit by

Back to Cyber Security