Security baseline audit checklist

Why run this

What this checklist is for

This list is deliberately unexotic. These are the controls that stop the attacks organizations actually experience, rather than the ones that appear in a threat briefing.

It is also, almost exactly, what your cyber insurance questionnaire asks. Answering it honestly gives you an actuarially weighted gap analysis for free.

Run it with

Business owner or managing director

And with

Whoever is responsible for IT

And with

Your insurance broker, for the questionnaire comparison

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Identity

More attack paths run through identity than through anything else on this list.

Multi-factor authentication enforced on every account with no exceptionsIncluding service accounts and administrators. One exempted account is the account that will be used.
Legacy authentication blockedIt bypasses conditional access and MFA entirely. Every other control on this list is weakened while it remains available.
Administrators use separate accounts from their daily onesAn administrator whose daily account holds standing privilege turns a routine phishing success into a full compromise.
Two break-glass accounts exist, excluded from policy and alerted onA misconfigured conditional access policy can lock every administrator out simultaneously. This is recoverable and it is a very long day.
Leaver process removes access within one business dayTest it. Pick somebody who left three months ago and check whether their access is genuinely gone.

Section 2

Endpoints and email

Where the intrusion usually starts.

Endpoint detection and response deployed to every deviceCompare the onboarded count against your actual device inventory rather than against expectation. The gap is usually real.
Disk encryption enabled and verified, not merely required by policyPolicy says required; the report says enabled. Check the report.
Operating systems and applications patched within a defined windowDefine the window, then measure against it. An undefined window is not a control.
Email filtering with impersonation protection configuredBusiness email compromise costs mid-market organizations more than ransomware and requires no malware at all.
Devices no longer in use are decommissioned and removed from the estateForgotten devices remain trusted and unpatched. They are found by attackers before they are found by inventory.

Section 3

Data and backup

What determines how bad a bad day gets.

Backups run, are immutable, and are not reachable from the production domainA backup an attacker can encrypt is not a backup. Immutability is the control that matters here.
A full restore has been rehearsed within the last twelve monthsNot tested in part. Rehearsed at scale. An untested backup is an assumption.
Recovery time and recovery point objectives agreed by the business, not by ITHow long you can operate without systems is a commercial decision. IT should be told the number, not choose it.
Data loss prevention configured for your most sensitive data typesStart with one or two types that genuinely matter rather than attempting comprehensive coverage.
Cloud storage sharing reviewed for anonymous and organization-wide linksMost organizations have shared more broadly than they intend, and the links outlive the reason for them.

Section 4

Response and governance

The part that converts detection into a shorter incident.

An incident response plan exists and has been rehearsed in the last yearWritten is not rehearsed. The rehearsal is where you find the dependency nobody mapped.
Somebody is authorised to isolate a device at 2am without seeking permissionContainment happens at ticket speed unless somebody has standing authority. Agree it on a Tuesday afternoon.
Security alerts reach a person who acts on them, at a volume they can workAn untuned console produces several hundred daily alerts and is functionally the same as no detection.
Your cyber insurance questionnaire is answered honestly and gaps are on a planAn aspirational answer creates a claims problem later that is considerably more expensive than a higher premium.
Somebody is named as accountable for security, even part-timeNot a committee. A person. Security with no owner degrades quietly and nobody notices until it matters.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

MFA has exceptions

Close them this week. An exempted account is the account that gets used, and this is the highest-value single fix available to you.

Legacy authentication still enabled

Block it. Run in report-only mode for a fortnight first to find what breaks, then enforce.

Backups never restore-tested

Schedule the rehearsal. Finding a broken dependency on a planned Saturday costs a weekend; finding it during an incident costs a week.

Alerts nobody reads

This is a tuning problem, not a staffing problem. Suppress the known-benign patterns and the queue becomes workable.

Want a second opinion on your score?

Send us your current insurance questionnaire and your licence position. We will map which gaps are already covered by entitlements you hold — usually more than expected — and what the remainder would take.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

business-central

small-mid-marketReadiness

ERP go-live readiness checklist

The twenty checks that decide whether a Business Central go-live is a quiet Tuesday or a month of firefighting.

July 18, 2026 · 20 checksOpen

sharepoint

small-mid-marketReadiness

Information architecture audit

Twenty checks on whether your file structure is helping people work or quietly costing them an hour a week.

January 10, 2026 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Identity

Endpoints and email

Data and backup

Response and governance

Read this against the number above

If you could not tick these, start here

MFA has exceptions

Legacy authentication still enabled

Backups never restore-tested

Alerts nobody reads

Want a second opinion on your score?

Related checklists

ERP go-live readiness checklist

Information architecture audit

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email