A 15-point security self-check for a small office.

1. Multi-factor sign-in is required on every email account.

   Email is where password resets for everything else arrive, so whoever gets into a mailbox can get into the rest. To check: in the Microsoft 365 or Google Workspace admin pages, look for any account, including the owner’s and shared mailboxes, where a second step is not enforced.

2. Multi-factor sign-in is on for banking, payroll and accounting.

   These are the accounts that move money. Sign in to each one and look in the security settings. If a system does not offer a second step, ask the vendor.

3. Backups ran successfully this week, and one copy is kept away from the office.

   A backup that stopped months ago looks the same as a working one until you need it. Open the backup software or service and read the date of the last successful run, then confirm where the second copy lives.

4. We have restored files from backup in the last three months.

   Restoring is the only proof a backup works. Pick a file from last month, restore it to a different folder and open it. Write down the date you did it.

5. Every computer installs security updates, and none runs an operating system that no longer gets them.

   Most attacks use holes that already have a fix. On each computer, open the update settings and check for pending updates and the date of the last install. Make a list of any machine too old to update.

6. People do not use administrator accounts for everyday work.

   If someone opens a bad attachment while signed in as an administrator, the attacker gets administrator rights too. In each computer’s account settings, check the account type. Daily accounts should be standard users, with a separate administrator login used only for installs.

7. Every former employee’s accounts are disabled.

   Old accounts are doors nobody watches. Compare the user list in email, the accounting system, remote access and the door alarm against your current staff list. Include shared passwords the person knew.

8. The firewall or router has been updated in the last year, and its default password was changed.

   This box faces the internet all day. Sign in to it and look for the firmware version and date. If nobody knows the login, or it is still the one printed on the label, that is your answer.

9. Guest Wi-Fi is separate from the network our computers use.

   Visitors’ phones and smart devices should not be able to see your file shares or printers. Connect a phone to the guest network and try to open a shared folder or a printer’s page. You should not be able to.

10. Staff use a password manager, and passwords are not reused or shared in a spreadsheet.

    When one website is breached, attackers try that password everywhere else. Ask your team how they keep track of passwords. Sticky notes, a shared document or “the same one with a different number” all mean no.

11. Every computer has endpoint protection that reports to one place someone actually looks at.

    Protection that is installed but expired, or alerting to nobody, does little. Count your computers, then count the devices shown in the security tool’s console. The numbers should match.

12. Incoming email is filtered, and our domain has SPF, DKIM and DMARC records.

    Filtering stops many bad links and attachments before anyone sees them. The three records help other mail systems reject messages that fake your address. Whoever manages your domain can look them up in minutes.

13. Any request to change bank details or send a wire is confirmed by calling a number we already had.

    Fake payment-change emails are common and convincing. Ask whoever pays the bills to describe the last time a vendor changed their bank details and what they did. The right answer involves a phone call, not a reply to the email.

14. Laptops and phones that hold business data are encrypted and lock themselves.

    A lost laptop without encryption is a data breach. With it, it is an expense. On Windows look for BitLocker or device encryption in settings, on a Mac look for FileVault, and on phones confirm a passcode is required.

15. We have a short written plan for a security incident, and staff know who to tell.

    In the first hour, people need to know who decides and who to call. One page is enough: IT contact, insurance claims line, bank, and how to disconnect a computer from the network. Keep a paper copy.

Nothing on this page is saved or sent anywhere. Your ticks stay in your browser and are gone when you close or reload the page. To keep a record, print the page or write the numbers down.