Menu

Are the basics in place?

12-point security checklist

Go through the twelve controls that matter most for a small business on Microsoft 365, see what good looks like for each, and get your own list of points to check.

FreeAbout 3 minutesRuns in your browser. Nothing is sent or stored

Free general information, not a confirmed result. This tool works only from your answers. It shows where to look, not a diagnosis, and gives no savings figures. Confirmed findings come only from a review of your own systems.

1Does every account, including admins, use multi-factor authentication?

What good looks like: Every account, including admins and shared accounts, needs a second step to sign in, enforced by policy rather than left to each person.

2Could you restore your email, files and servers from a backup tested in the last six months?

What good looks like: Microsoft 365 data is backed up as well as servers, one copy is out of attackers' reach, and a restore has been tested recently.

3Do admins use a separate admin account that is not used for email or browsing?

What good looks like: A small number of named admins, each with a separate admin-only account, plus two protected emergency accounts.

4Are older sign-in methods (such as POP, IMAP and basic authentication) switched off?

What good looks like: Legacy sign-in methods are blocked, because they skip the second sign-in step.

5Are critical updates installed within 14 days on all laptops, servers and phones?

What good looks like: Critical and high-risk updates go on within 14 days, the Cyber Essentials standard, and devices that fall behind are chased.

6Are leavers' accounts disabled on their last day?

What good looks like: A written leaver checklist, owned by one person, disables the account and removes licences on the last day.

7Are laptops and phones that hold company data managed and encrypted?

What good looks like: Devices are managed centrally, encrypted, and can be wiped if lost.

8Does someone review security alerts or your Microsoft Secure Score at least monthly?

What good looks like: One named person owns security alerts and reviews them on a schedule, with your IT provider responding to serious ones.

9Is your email domain protected with SPF, DKIM and DMARC?

What good looks like: SPF, DKIM and DMARC are set, so criminals cannot easily send email that appears to come from you.

10Have staff had phishing awareness training in the last 12 months?

What good looks like: Short phishing awareness sessions at least once a year, and an easy way to report a suspicious email.

11Is sharing with people outside the company limited, with "anyone" links restricted?

What good looks like: "Anyone with the link" sharing is off or limited, and external sharing is allowed only where it is needed.

12Is there a written plan for who to call and what to do in a cyber incident?

What good looks like: A one-page plan says who decides, who to call (insurer, IT provider, legal) and how you will communicate.

More free tools