A cyber security audit checklist is a fixed list of checks that tells you where your defences stand today — what is protected, what is assumed and what is open. For a small business it replaces guesswork with a score you can act on and, importantly for 2026, evidence you can hand to an insurer, an assessor or a tender panel.
This checklist is written for a 5-50 person business. It covers the same ground as a formal gap assessment in lighter form: run it yourself in an afternoon, score each item pass/fail, and fix the fails in priority order.
TL;DR
- The 12 checks cover identity, devices, email, data, backup, training and evidence — the areas small businesses actually get breached through.
- Score pass/fail per item; a business that fails the first five should fix those before anything else.
- The highest-cost failures in Australia are missing MFA, untested backups and untrained staff — the three that turn a contained incident into an expensive one.
- Re-run the checklist quarterly and after any major change (new system, new office, new staff cohort).
- Where a check involves staff behaviour, measure it — training with reporting gives you the numbers rather than an assumption.
The checklist
1. Multi-factor authentication on every external login
Email, accounting, CRM, remote access, admin accounts. A single account without MFA is the most common entry point in Australian small-business breaches. Check: list your cloud apps, confirm MFA is enforced (not optional) on each.
2. Backups that are tested, not just scheduled
A backup that has never been restored is a hope, not a control. Check: run a restore of a critical file and a critical system this quarter, and confirm at least one copy is offline or immutable so ransomware cannot reach it.
3. Patching within a defined window
Check: operating systems, browsers and line-of-business apps are set to auto-update, and no device is running an OS that no longer receives security updates.
4. Email authentication configured
Check: SPF, DKIM and DMARC are published for your domain — DMARC at least at monitoring (p=none) so you can see who sends as you.
5. Staff trained within the last 30 days
Awareness decays; the 2026 benchmark is monthly micro-training, not an annual course. Check: completion is current and click/report rates from simulations are tracked. If the last session was last year's induction, this fails.
6. Phishing simulations running on a cadence
Check: at least monthly, with auto-enrolment into follow-up training for anyone who clicks.
7. A reporting path staff actually use
Check: a report button in the mail client, a stated no-blame policy, and a log of reports received. Zero reports usually means the path is broken, not that nothing arrived.
8. Access reviewed and leavers removed
Check: a leaver's accounts are disabled the day they finish; no shared logins for finance or admin systems; admin rights held only by people who need them.
9. Device security baseline
Check: disk encryption on, screen lock enforced, endpoint protection present and healthy on every laptop and phone that touches business data.
10. Payment-verification habit for finance
Check: finance staff verify any bank-detail change by phone on a stored number, and verify unusual payment requests through a second channel. This single habit stops the most expensive scam class in Australia.
11. An incident plan on one page
Check: staff know who to call in the first five minutes after a suspected click — IT contact, whether to disconnect, how to reach the bank if money moved.
12. Evidence filed where an assessor can find it
Check: training completion records, simulation results, backup-restore logs and policy sign-offs are kept and dated. This is the checklist item that converts the other eleven into tender and audit value.
How to score it
| Score | Meaning | Action |
|---|---|---|
| 11-12 pass | Strong baseline | Maintain cadence, re-check quarterly |
| 8-10 pass | Gaps concentrated somewhere | Fix the lowest-numbered fails first |
| Under 8 pass | Exposed | Prioritise MFA, backups and training this month |
Weight matters more than the count: the checklist is ordered deliberately, and a business that passes everything but check 1 is carrying more risk than one that fails two mid-list items. If more than half of the checks fail, do not run the whole remediation yourself — the What is the Essential Eight? guide and a gap assessment give you the sequencing.
How often to re-run the audit
- Quarterly as the standing cadence — enough to catch drift in MFA coverage, patching and training currency.
- After any material change: a new system, a move to hybrid work, a burst of hiring or a new finance platform.
- Before anything that checks you: insurance renewal, a certification push, a tender submission. Auditors and panels ask for exactly this evidence, and having it current is the difference between a clean pass and a scramble.
FAQ
What is a cyber security audit checklist? A fixed list of control checks — identity, devices, email, backup, training, evidence — run on a schedule, scored pass/fail, and used to prioritise fixes and produce evidence for auditors and insurers.
How is an audit different from a gap assessment? An audit checklist is a self-run snapshot, usually in an afternoon. A gap assessment is deeper: benchmarked against a framework like Essential Eight or SMB1001, with a remediation roadmap and often an external assessor.
What should a small business check first? The first five: MFA everywhere, tested backups, patching, email authentication, and current staff training. Those five cover the majority of real-world small-business breach paths.
How long does a cyber security audit take? For a small business using this checklist, half a day for the checks plus a few hours chasing evidence. The training and simulation items are quick if a platform produces the reports; slow if you have to assemble them by hand.
Do I need this if we already have an MSP? Yes — an MSP runs the controls; this checklist verifies them. Ask your MSP for the evidence items in check 12 directly. If they cannot produce current training records and a restore log, that is a finding.
One last thing
Print the twelve checks and score them honestly today. The value is not the score — it is the two or three fails you did not know about, and the evidence file that starts building the moment you fix them. When the behavioural items (5-7) fail, the fastest fix is a monthly training cadence with reporting built in, and the small-business training guide shows the rollout sequence.