FREE GUIDE · PERTH SMALL BUSINESS
You do not need a technical audit to spot the most common gaps. Work through these eight questions with the person who handles your business systems. Anything you cannot answer becomes a useful next step.
This is a starting point, not a security certification. Every business has different systems, risks and obligations. Avoid placing passwords or confidential information in your notes.
Write down which authorised person controls your domain, Microsoft 365 or Google Workspace, internet service, website and backups. Record where recovery details are kept—never place passwords in the checklist itself.
Start with email and administrator accounts. Check that recovery methods belong to the business and remove old phone numbers or personal email addresses that should no longer have control.
List the computers, phones, routers and other business-owned equipment your team relies on. Note who uses each device and whether it still receives security updates.
Confirm operating systems, browsers, security tools and network equipment are supported and updating. “Automatic” is a setting worth verifying, not an outcome to assume.
Identify the files, email, cloud data and systems you cannot afford to lose. Check who receives backup alerts and arrange an agreed recovery test for a safe sample before a real incident forces the question.
Make sure new starters receive only the access they need and departing staff are removed promptly. Shared logins make it harder to know who changed what; use individual accounts where practical.
Keep your internet provider, account holder, router details and important support contacts somewhere authorised staff can reach. Note where poor Wi-Fi or drop-outs occur and when they happen.
Decide who staff contact for an IT problem, suspected scam, lost device or outage. A simple escalation path is more useful than an emergency plan nobody can find.