SME Cyber Protection Checklist

25 practical controls. Tick what's already in place — see how you score.

Identity & access

MFA enforced on email and admin accountsPassword manager rolled out to staffJoiner / leaver process removes access within 24hNo shared admin accountsPrivileged access reviewed quarterly

Devices & patching

All devices encrypted at rest (BitLocker / FileVault)OS auto-updates enabled and verifiedMobile devices enrolled in MDMUSB and removable media policy in placeAnti-malware on every endpoint

Email & web

SPF, DKIM and DMARC configured (DMARC at p=quarantine+)External-sender warning banner enabledWeb filtering blocks known malicious categoriesPhishing simulation run in last 12 monthsReporting button in mail client (Report phish)

Backups & recovery

3-2-1 backup strategy in operationAt least one offline / immutable copyRestore tested in last 6 monthsDocumented incident response planCyber insurance policy in force

Governance

Acceptable use policy signed by all staffAnnual cyber awareness training completedSupplier security reviewed for top 5 vendorsICO registered + GDPR records of processingCyber Essentials (or Plus) achieved or scheduled

Score

0 / 25 controls

Posture

At risk

Aim for 80%+ before pursuing Cyber Essentials Plus or attesting to enterprise customers.

From the SMB Blog

SME Cyber Protection Checklist

Related reading on smallmediumbusiness.co.uk