A security gap assessment tells you where your small business is exposed before an attacker or an auditor does. You do not need a consultant to run a first pass — you need a structured day, admin access to the tools you already own, and this checklist.
Key takeaways
- A small-business gap assessment covers ten areas: inventory, email security, MFA, patching, backups, access control, staff training, incident response, policies and evidence.
- Most Australian small businesses already own the tools that fix the biggest gaps — Microsoft 365 and Google Workspace ship with the controls the Essential Eight expects at Maturity Level 1.
- Score each area red, amber or green rather than trying to quantify risk precisely; the goal is a ranked fix list, not a research paper.
- Re-run the assessment every six months, or after any major change like a new system, office or outsourced IT provider.
What a gap assessment covers (and what it doesn't)
A gap assessment compares the security you should have against the security you have. It is not a penetration test — nobody attacks your systems. It is not a compliance audit either: no certificate comes out of it. The output is a short, ranked list of gaps with a fix and an owner for each.
For Australian small businesses, the natural benchmark is the ACSC's Essential Eight at Maturity Level 1, because it is free, designed for your size, and what insurers and government tenders increasingly reference.
The 10-step small business gap assessment checklist
Run the steps in order. Budget half a day for a business under 50 staff.
- Inventory what you run. List every system holding business or customer data: email, accounting, CRM, file storage, website admin, industry software. You cannot protect an asset you have not listed.
- Check email security. Confirm SPF, DKIM and DMARC records are published for your domain. Email is the number-one small business attack path — spoofable email domains make every later control weaker.
- Turn over MFA. Multi-factor authentication must be on for email, accounting, banking and every admin account. Note which systems still allow password-only sign-in — each one is a gap.
- Check patching. Are operating systems and browsers set to auto-update? Is someone responsible for patching the industry software and routers? Unpatched applications are Essential Eight strategy two and three for a reason.
- Test backups. When did a backup last restore successfully? A backup nobody has restored is a hypothesis, not a control. Check at least one critical system is covered and offline or immutable.
- Review who has admin rights. Count people with administrator access to email, systems and devices. Every admin account beyond the people who need it widens the blast radius of one stolen password.
- Assess staff preparedness. When did staff last complete security training? Has a phishing simulation ever been run? Human error features in most small business breaches, so this area rarely comes out green.
- Write the incident plan. One page: who turns off what, who calls whom, which insurer and IT provider, within what timeframes. If it exists only in the owner's head, it is a gap.
- Check policies exist and are acknowledged. At minimum: acceptable use, password policy, data handling. Signed and dated — an unsigned policy is decoration.
- Collect the evidence. Screenshots or exports of MFA status, backup logs, training completion and DMARC records. Assessment day, insurance renewal and tender responses all draw from this folder.
Scoring and what to do with the results
Score each of the ten areas green (done and evidenced), amber (partially done) or red (missing). Then rank fixes by two questions: what is cheapest to fix, and what blocks a business goal such as an insurance renewal or a tender?
Typical first-month fixes for a small business: enable MFA everywhere (hours, free), publish DMARC (an afternoon, free), turn on Microsoft 365 or Google backup and retention (hours, low cost), and enrol staff in a structured security awareness training programme with a baseline phishing simulation (an afternoon of setup).
Common mistakes
- Assessing only IT's view. Ask finance where payments are approved and operations what staff actually click on; the human layer is where most incidents start.
- Treating the assessment as one-off. Gaps reopen as systems change; a six-month re-run keeps the fix list honest.
- Fixing everything at once. Red items get an owner and a date; trying to fix all ten areas in a week is how assessments die in a drawer.
If the list comes back longer than expected, a structured security gap assessment service scores the same ten areas for you and hands back the ranked plan — useful when the business is between IT providers or the owner is the whole IT department.
Related questions
How long does a small business gap assessment take?
Half a day to one day for a business under 50 staff using this checklist, plus a week to apply the quick fixes. A consultant-led assessment typically takes two to four weeks end to end.
Does a gap assessment satisfy cyber insurance requirements?
It prepares you for the questionnaire — insurers ask about MFA, backups, training and incident response, which are steps 3, 5, 7 and 8 here. The assessment itself is not a certificate, but its evidence folder answers most renewal questions.
Should we use the Essential Eight or SMB1001 as the benchmark?
Use the Essential Eight if you want a free hardening roadmap or government tenders are in play; use SMB1001 if a client or insurer wants a certificate. The controls overlap heavily — see our SMB1001 vs Essential Eight comparison for the detail.
FAQ
What is a security gap assessment? A structured review comparing your current security controls against a benchmark such as the Essential Eight. The output is a ranked list of gaps with fixes, owners and dates — not a test, and not an audit.
How often should a small business run one? Every six months, and after any major change: new systems, new offices, a change of IT provider or a security incident.
Can we run it ourselves without an IT background? Yes for steps 1, 7, 8, 9 and 10. Steps 2-6 need admin access to your systems — if you outsource IT, your provider can produce the evidence for those in an hour.