Where can I find a free cybersecurity checklist for a company?

A free cybersecurity checklist for a company is right on this page: 15 items in seven groups (accounts, email, devices, backups, website, people, incidents), each with one line on how to verify it, plus a printable PDF with no sign-up. For specific topics, below are links to detailed checklists and worksheets, and to the free guides from the NCSC, ENISA and NIST that this list is based on.

A cybersecurity checklist means a short list of checks where every item can be honestly answered "yes" or "no" and backed up with evidence. This list is written for a small company without a dedicated security specialist: the owner, the office manager and the IT contractor can go through it in one meeting.

In short

• The first items give the most value: a second login factor, few administrators, access closed for people who have left.
• Every item has a way to verify it. "I think so" does not count.
• A backup only matters if you have already restored from it.
• Repeat the list every quarter and after big changes: a new service, an email migration, a new contractor.
• Once every item is closed, the next step is an independent check of what actually works.

A 15-item checklist

Tick an item only after you have checked it the way the text after the colon says.

• Accounts. Everyone has a second login factor (MFA, a code or a confirmation on the phone) for email, online banking, the CRM and hosting: the email admin centre shows no users without MFA.
• Accounts. There are two or three administrators, each with a separate admin account: review the list of roles in the admin centre.
• Accounts. Nobody who has left still has work access: compare the list of leavers from the past year with active accounts in email, the CRM and cloud drives.
• Email. SPF, DKIM and DMARC (domain records that protect your address from being faked) are set up: ask IT to show you these three records for your domain.
• Email. Automatic forwarding to external addresses is blocked: check the forwarding policy in the email admin centre.
• Devices. Laptops and phones install updates automatically: open the update settings on three random laptops.
• Devices. Laptop disks are encrypted and screens lock by themselves: check that BitLocker or FileVault is on.
• Backups. Important data is copied automatically and one copy is kept separately with different passwords: ask where exactly that copy is and who can access it.
• Backups. Restoring has been tested: restore one file and one database as of yesterday and time it.
• Website. The site's content management system, plugins and server are up to date: look at the versions and the last update date in the site's admin panel.
• Website. Access to the domain, hosting and site admin belongs to the company and is protected with MFA: try to log in without the contractor.
• People. Passwords are kept in a password manager, not in spreadsheets: search the shared drive for files with "passwords" in the name.
• People. Changes to bank details are confirmed by calling a known number: ask the accountant what they would do with an email about a supplier's new account.
• Incidents. There is a printed contact list (IT, bank, hosting, domain registrar, CERT-UA, cyber police): find that sheet and check two of the numbers.
• Incidents. Everyone knows who decides and what to do first if email is hacked: talk this scenario through in a 15-minute meeting.

Download the preparation checklist (PDF)PDF · A4

The items are based on the NCSC guide for small organisations, ENISA's 12 steps for small and medium businesses and NIST's materials for small businesses. ^{[1] [2] [3]} Email forwarding and device updates are covered in separate guidance from Microsoft and the NCSC. ^{[4] [5]}

Detailed checklists by topic

If an item raised doubts, open the detailed article on that topic.

How to use the checklist

Pick one person to collect the answers and set up one meeting of about an hour. Next to each item, write down who owns it and the date of the next check. Treat items answered "I don't know" as open: that is already a useful result.

If something is happening right now, skip the list, open the guide on the first 30 minutes and report to CERT-UA (Ukraine's government cyber incident response team). ^{[6] [7]}

What to do when everything is ticked

The checklist shows what is set up on paper. Whether it really works takes an independent look: a Security Assessment checks accounts, email, cloud services and access rights and explains what to fix first. If you have your own website with a customer area or an API, the next step is a pentest.

FAQ

Where can I find a free cybersecurity checklist for a company?

On this page: 15 items with a way to verify each one and a printable PDF with no sign-up. Detailed checklists by topic are in the table above, and worksheets are on the resources page.

How long does a check against the checklist take?

Usually one meeting of about an hour, if someone with access to the email admin centre is in the room. Fixes take longer: MFA and the accounting rule can realistically be introduced within a week, sorting out backups and access usually takes a few weeks.

Can we go through the checklist without an IT specialist?

Partly. The owner can check the items on people and incidents alone. Accounts, email and backups need someone with access to the admin centre, most often the IT contractor.

How often should we repeat the check?

Every quarter and after big changes: a new service, an email migration, a change of IT contractor, the departure of someone with wide access.

Is a checklist enough to be secure?

No. It closes the simplest paths attackers usually use, but it does not reveal hidden problems. That takes an independent check, such as a Security Assessment.

References

1. NCSC: Small organisations guide to cyber security ncsc.gov.uk
2. ENISA: Cybersecurity guide for SMEs, 12 steps to securing your business enisa.europa.eu
3. NIST: Small Business Cybersecurity Corner nist.gov
4. Microsoft: Control external email forwarding learn.microsoft.com
5. NCSC: Keeping devices and software up to date ncsc.gov.uk
6. NCSC: Incident management ncsc.gov.uk
7. CERT-UA: Computer Emergency Response Team of Ukraine cert.gov.ua