Skip to content
IT-Checklist

Cybersecurity: checklist and advice

Last updated: · IT-Checklist editorial team · All changes

Cybersecurity sounds like something for large organisations with their own security team. Yet the attacks that hit SMEs are usually not targeted at all. Criminals scan the whole internet for outdated software and send the same phishing email to thousands of companies. If your basics are in order, you quickly drop off their list.

The questions in this topic cover those basics: updates, security software, staff who know what to look out for and a protected email domain. Plus knowing what to do when something goes wrong anyway.

Check where your business stands on cybersecurity

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Ransomware often starts with one opened attachment, or with one system that is missing the latest patches and can be reached from the internet. The attacker then encrypts your files and asks for a ransom. For a small business that means days or weeks of downtime.

Without SPF, DKIM and DMARC, anyone can send email that seems to come from your domain. Customers then get fake invoices with your name on them. Your real mail also lands in spam more often.

The 14 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. All computers and phones receive security updates automatically.

    Do first

    Enable automatic updates on all devices and check monthly that everything is up to date, including browsers and plugins.

  2. All computers run up-to-date antivirus/endpoint protection.

    Important

    Use at least the built-in protection (Microsoft Defender) and consider a business endpoint solution as you grow.

  3. Employees know how to recognise phishing and where to report suspicious messages.

    Important

    Discuss phishing regularly, share examples and agree on a single reporting point. Consider a short annual training.

  4. We know what to do in case of a cyber incident (who to call, what to do first).

    Important

    Create a one-pager with incident steps: isolate systems, change passwords, call IT support and insurance, preserve evidence.

  5. Important business data is stored encrypted (disk encryption on laptops, encrypted cloud).

    Recommended

    Enable BitLocker (Windows) or FileVault (Mac) on all laptops. If stolen, your data remains unreadable.

  6. We have cyber insurance or have consciously decided not to take it out.

    Recommended

    Investigate what cyber insurance costs and covers (e.g. ransomware response and liability) and make a conscious choice.

  7. Our email domain is protected against spoofing with SPF, DKIM and DMARC.

    Important

    Have SPF, DKIM and DMARC configured on your domain (via your IT admin or hosting provider). This prevents criminals from sending emails in your name.

  8. We do not use outdated software or systems that no longer receive security updates (e.g. old Windows versions).

    Important

    Identify software and systems that are end-of-life and replace or isolate them. A single outdated machine can be the gateway into your entire network.

  9. Employees cannot freely install software on work computers (no admin rights by default).

    Recommended

    Give employees a standard user account without admin rights. This blocks much malware and prevents a sprawl of unmanaged software.

  10. Macros and attachments from unknown sources are blocked or only opened after verification.

    Recommended

    Block Office macros from internet sources (on by default in Microsoft 365 — verify it) and agree that unexpected attachments are verified first.

  11. Systems are not needlessly exposed directly to the internet; remote work goes through a secured connection (VPN or similar).

    Important

    Never expose remote desktop or a NAS directly to the internet. Use a VPN or a business remote access solution with MFA; open ports are scanned within minutes.

  12. We test our incident plan at least once a year with a short exercise (e.g. a tabletop exercise).

    Important

    A plan on paper works differently in practice. Once a year, walk through a scenario (e.g. 'we've been hit by ransomware') and see what works and what doesn't.

    Applies to: SMEs, larger companies

  13. We periodically test employees with a simulated phishing email to measure and improve alertness.

    Recommended

    Various vendors offer affordable phishing simulations. Use the results to train, not to punish — that way it stays a learning moment.

    Applies to: SMEs, larger companies

  14. Vulnerabilities in software and systems are actively scanned for and resolved within a set timeframe (patch policy).

    Important

    Automatic updates catch a lot, but not everything. Run a periodic vulnerability scan and agree on a timeframe within which critical flaws must be fixed.

Where to start

  • Turn on automatic updates on every computer, phone and tablet. Replace devices that no longer get security updates.
  • Test your email domain for free at internet.nl. If the test shows red, ask your hosting provider to set up SPF, DKIM and DMARC.
  • Write down on one page who you call during an incident (IT partner, bank, insurer) and the first three steps. Go through that page with the team once a year.
  • Take standard admin rights away from staff. Then not everyone can install software.

Common mistakes

  • Assuming the antivirus stops everything and letting updates slide because of it.
  • Having an incident plan nobody knows about, because it was never practised.
  • Leaving remote desktop or an admin panel open to the internet 'because it makes working from home easy'.

Official sources

Read next

All topics in the checklist