Checklist · Cyber Security

Cyber Security Checklist for Organisations Without a Security Team

The controls that stop most real attacks, ranked by protection per unit of effort — plus the AI-specific surface. Written for organisations where one person also does IT.

Download the checklist Read the full guide

Markdown. No sign-up, no email.

Organisation: _______________ Date: _______ Completed by: _______________

Ranked by protection per unit of effort, not by framework section number. Sections 1–2 stop most of what actually happens. Do those before anything else.

1. The six that do most of the work#

[ ] Multi-factor authentication on email — do this first. Email resets every other password
[ ] MFA on all financial systems
[ ] MFA everywhere else it is offered
[ ] Automatic updates enabled where you can tolerate them
[ ] A written list of every system you run, who owns it, where updates come from
[ ] Backups: 3 copies, 2 media, 1 offline or immutable
[ ] A real restore tested in the last quarter — not a "backup job succeeded" message
[ ] Least privilege — nobody is an administrator by default
[ ] Leaver access removed same-day
[ ] Payment detail changes verified out of band — phone the number you already had, never the one in the email

2. Accounts#

[ ] No shared accounts — every action attributable to a person
[ ] Password manager provided and used
[ ] Default credentials changed on every device and service
[ ] Access reviewed in the last quarter
[ ] Dormant accounts disabled
[ ] Administrative work done from a separate account, not the one used for email

3. Devices#

[ ] Disk encryption on laptops and phones
[ ] Screen lock enforced
[ ] Remote wipe available
[ ] Endpoint protection installed and reporting
[ ] Personal devices with company data covered by something

4. Data#

[ ] You know what personal data you hold and where
[ ] Not stored where it does not need to be
[ ] Encrypted in transit — TLS everywhere
[ ] Retention period defined and actually enforced
[ ] Test environments do not contain real personal data

5. Suppliers#

[ ] List of suppliers holding your data
[ ] What each holds, recorded
[ ] Their breach notification obligation to you, known
[ ] Contractor access removed when engagements end

6. AI-specific surface#

[ ] Approved AI tool provided whose terms exclude training on your data
[ ] Staff told which tool, and what may not be pasted into it
[ ] If you built anything with a model: it cannot reach systems beyond its declared tools
[ ] Destructive or outbound actions require human approval
[ ] Prompt injection considered — what happens if retrieved content contains instructions?
[ ] No component holds both broad read and broad write access
[ ] AI disclosure in place — EU AI Act Art. 50 has applied since 2 Aug 2026
[ ] Deepfake / voice authorisation defended by out-of-band verification, not by recognising a voice

7. People#

[ ] Training focuses on process, not spotting bad English — AI phishing is fluent
[ ] Everyone knows how to report a suspected phishing message
[ ] Reporting is rewarded, never punished
[ ] Everyone knows that urgency is itself a warning sign

8. If something goes wrong#

[ ] One named person with authority to disconnect systems and spend money
[ ] A named deputy
[ ] Fallback communication channel agreed, if email is compromised
[ ] Contact list stored offline — insurer, legal, IT provider
[ ] Regulatory notification window known before the clock starts
[ ] Rule agreed: preserve evidence before rebuilding

Sign-off#

	Name	Date
Completed by
Reviewed by

Accepted risks:

#	Not met	Why accepted	Revisit by

Back to Cyber Security