Cybersecurity Audit Checklist for Small Business (Free Template)

What a Cybersecurity Audit Actually Is (and Isn’t)

A cybersecurity audit is a structured review of your business’s security controls against a defined standard — identifying what’s in place, what’s missing, and what needs improvement. For a small business, it doesn’t require an external auditor, a specialist tool, or a week of downtime. It requires honest answers to specific questions, and a commitment to addressing what you find.

What a cybersecurity audit is not: it is not a penetration test (where someone attempts to actively break into your systems), not a vulnerability scan (automated scanning of systems for known weaknesses), and not a one-time exercise. An audit reviews your programme — your policies, your controls, your processes — and assesses whether they meet an acceptable standard. Penetration testing and vulnerability scanning are components that a more advanced programme adds alongside the audit.

Who should use this checklist:

• Business owners who have never formally reviewed their security posture
• IT administrators conducting their first structured security review
• Businesses preparing for cyber insurance underwriting or renewal
• Businesses preparing for a client security questionnaire or vendor assessment
• Any business that has implemented security controls and wants to verify they’re complete

How long it takes: Allow 2–4 hours for a small business with 5–25 employees. Larger environments or businesses with more complex IT infrastructure should allow 4–8 hours. The output is a gap list with prioritised remediation actions.

How to use the scoring: Each item has three possible statuses:

• ✅ In place — control is implemented and operating effectively
• ⚠️ Partial — control exists but has gaps (not fully implemented, not consistently applied, or not documented)
• ❌ Not in place — control is missing

At the end of each section, count your statuses. A section with mostly ❌ is a priority area. A section with mostly ⚠️ needs tightening. A section with mostly ✅ is your current strength baseline.

Section 1: Identity and Access Management

Access control failures — shared passwords, lingering accounts for departed staff, no MFA — are present in the majority of small business breaches. This section is typically the highest-impact area for improvement.

Section 1 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 2: Endpoint Security

Every device that accesses business data is a potential attack entry point. This section covers the security of those devices.

Section 2 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 3: Patch Management and Software Currency

The majority of successful exploits in 2026 target known vulnerabilities with available patches. Unpatched software is the path of least resistance for attackers.

Section 3 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 4: Network Security

Network security controls protect the infrastructure that all devices and systems rely on.

Section 4 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 5: Data Protection and Backup

Data loss and ransomware are the highest-impact incident types for small businesses. This section covers the controls that determine whether a business survives one.

Section 5 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 6: Email and Phishing Protection

Over 90% of successful cyberattacks begin with a phishing email. Email security controls and employee awareness are the primary defence.

Section 6 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 7: Vendor and Third-Party Security

Third-party breaches cause 29% of business security incidents. Every vendor with access to your systems or data is a potential entry point.

Section 7 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 8: Incident Response Readiness

When a breach happens, the quality of your response in the first 24–72 hours determines the outcome. This section assesses whether you’re ready.

Section 8 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 9: Security Awareness and Training

The human layer is both the largest vulnerability and the most cost-effective control to improve. This section assesses the training programme.

Section 9 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Section 10: Governance, Policies, and Compliance

Policies, documentation, and governance create the structure that makes all other controls sustainable. Without them, controls are implemented inconsistently and fail under scrutiny.

Section 10 score: _____ in place / _____ partial / _____ not in place

Highest priority gaps identified:

Scoring Summary and Action Plan Template

After completing all 10 sections, summarise your findings here.

Overall Score Summary

Priority Interpretation

Sections with 3 or more ❌: Critical gaps — address within 30 days. These represent fundamental controls that leave your business materially exposed to common attack types.

Sections with 3 or more ⚠️: Significant gaps — address within 90 days. Controls exist but are inconsistent, undocumented, or partially implemented. These will typically fail during a genuine incident or insurance/compliance review.

Sections with mostly ✅: Maintain and document. These are your security strengths. Ensure they remain current through annual reviews.

Action Plan Template

Complete this for each gap identified during the audit.

Priority guidance:

• High: Any ❌ in Section 1 (Access), Section 5 (Backup), or any control directly required by your cyber insurance policy
• Medium: Any ❌ in Sections 2, 4, 6, 8 / Any ⚠️ in Sections 1 and 5
• Low: ⚠️ items in Sections 3, 7, 9, 10

How to Run This Audit: Practical Guidance

Who should complete it

The person completing this audit needs to know your IT environment well enough to answer accurately. For a very small business where the owner manages everything: the owner completes it. For a business with an IT administrator: the IT administrator completes it. For a business managed by an MSP: the MSP completes it and reviews findings with the owner.

The most common audit failure is providing aspirational answers — “we probably do this” or “we should be doing this” scored as ✅. The purpose of the audit is to find the honest gaps, not to produce a clean score. An audit that finds no gaps in a business without a documented security programme is not a clean audit — it’s an inaccurate one.

Gathering evidence

For each item you score ✅, you should be able to point to evidence that it’s actually in place:

• MFA is enabled: a screenshot of the MFA configuration in your email provider
• Backup restoration was tested: a record of the test date and what was restored
• Policies are reviewed annually: a document with a revision date
• Former employee accounts are removed: an offboarding checklist with completion dates

Evidence doesn’t need to be elaborate. A dated email confirming an action was completed, a screenshot of a configuration screen, or a brief note in a shared document is sufficient. Evidence is what protects you when an insurer, auditor, or regulator asks whether a control was actually in place.

Common honest findings

The gaps most commonly found in small business cybersecurity audits — the items businesses think they have but actually don’t:

Backup restoration has been tested. Most businesses back up. Far fewer have tested restoration. The backup process running doesn’t mean the backup is restorable. Schedule a test.

No former employees have active accounts. Almost every business finds at least one departed employee’s account still active on at least one system during their first audit. Run through the list of leavers from the past two years and verify access removal on every system.

MFA is enabled on all cloud services. Businesses enable MFA on their primary email but forget the CRM, the accounting software, the cloud backup, the payroll system, the social media business accounts, or the various SaaS tools added over time. Audit every cloud service against MFA status.

The incident response plan has been tested. Writing a plan is not the same as testing it. A 30-minute tabletop exercise walkthrough is sufficient for a first test. Without testing, nobody knows whether the plan actually works.

Shadow IT has been addressed. Employees use tools for work that IT doesn’t know about. Ask employees directly what tools they use daily. Every unapproved tool that touches business data is a gap.

What to do with the gap list

After completing the audit, you have a gap list. The next step is prioritisation and an action plan:

1. Identify the highest-risk gaps — anything that would cause significant harm in a breach scenario or that fails a cyber insurance requirement
2. Assign an owner to each gap — a named person responsible for closing it
3. Set a target date — realistic but time-bound
4. Revisit the action plan monthly until all high-priority gaps are closed
5. Schedule the next audit — annual is the minimum; semi-annual is better for rapidly changing environments

What the Audit Doesn’t Cover

This checklist covers the broad landscape of small business cybersecurity controls. It does not replace:

Vulnerability scanning: Automated scanning of your systems and network for known vulnerabilities and misconfigurations. Tools like Tenable.io, Qualys, or even free options like OpenVAS provide this. PCI DSS compliance requires quarterly external vulnerability scans from an Approved Scanning Vendor.

Penetration testing: Active testing by a specialist who attempts to find and exploit vulnerabilities in your environment. Typically costs $5,000–$15,000 for a small business scope. SOC 2, ISO 27001, and NIS2 all expect penetration testing on at least an annual basis.

Dark web monitoring: Checking whether your employees’ credentials have appeared in breach dumps or stealer logs. Our dark web monitoring article covers the tools available for this.

Full compliance audit: This checklist covers security controls that underpin compliance with GDPR, HIPAA, PCI DSS, Cyber Essentials, and other frameworks. A formal compliance audit for any of those frameworks requires additional framework-specific evidence and typically involves an external assessor.

How Often to Run This Audit

Annual minimum: At minimum, run this audit once per year. Security posture changes as you add staff, adopt new tools, change cloud services, and expand or contract operations. An annual audit catches drift.

After significant changes: Any of the following should trigger a mid-cycle audit review:

• Adding a new major cloud service or IT platform
• Significant staff changes (large new hire cohort, senior departures)
• Moving to a new office or significant infrastructure change
• Experiencing a security incident
• Receiving a new cyber insurance policy or renewing an existing one

Before a security questionnaire or compliance review: If a client, partner, or insurer asks about your security posture, run this audit first. Completing it honestly gives you an accurate picture of what you can attest to and what needs addressing before you respond.

Final Verdict

A cybersecurity audit is not a compliance exercise — it’s a gap-finding exercise. Its value is in the honest gaps it reveals, not in the score it produces. A business that completes this checklist honestly and acts on what it finds is meaningfully more secure than one that produces a clean-looking score that doesn’t reflect reality.

The 10 sections cover the foundational security domains that determine whether a small business can withstand and recover from the most common attack types in 2026. Completing all 10 sections takes a few hours. Acting on the gap list takes weeks to months. The protection it provides lasts for the year before the next audit.

Start with Section 1 (Identity and Access Management) — it’s the highest-impact area for most small businesses and the controls are primarily free to implement. Enable MFA on everything, remove former employees’ accounts, deploy a password manager. Those three actions close the most common breach vectors before you’ve spent a penny on security tools.

Frequently Asked Questions

How much does a cybersecurity audit cost for a small business?

A self-conducted audit using this checklist costs only staff time — typically 2–4 hours for a business with 5–25 employees. A professionally conducted external cybersecurity audit by a specialist firm typically costs $7,500–$40,000 depending on scope, company size, and whether it maps to a specific compliance framework. External audits provide independent assessment and are appropriate when preparing for SOC 2, ISO 27001, or client due diligence that requires third-party attestation. For most small businesses, a rigorous self-assessment using this checklist, followed by an annual review with your IT provider or MSP, is the appropriate starting point.

How is a cybersecurity audit different from a penetration test?

A cybersecurity audit reviews your security programme — the policies, controls, and processes you have in place — and assesses whether they meet an acceptable standard. It’s a documentation and process review. A penetration test involves a specialist actively attempting to exploit vulnerabilities in your systems to find weaknesses that automated scanning and documentation review wouldn’t reveal. Audits assess what you have; penetration tests try to break what you have. Both are valuable; the audit typically comes first because it reveals control gaps that should be addressed before a penetration test makes them visible to an external party.

What should I do if I find a lot of gaps?

Prioritise ruthlessly. A business that tries to close all gaps simultaneously typically closes none — the scope is too broad and nothing gets finished. Pick the three to five highest-risk gaps — typically items in Identity and Access Management, Backup, and Endpoint Security — and close those first. Set a 30-day deadline for the highest-priority items. Then move to the next tier. Progress is better than perfection, and closing five critical gaps in a month is significantly more valuable than attempting all twenty and completing none.

Can I use this checklist for cyber insurance purposes?

This checklist helps you understand your security posture and prepare for cyber insurance underwriting. Most cyber insurance questionnaires ask about specific controls — MFA on all accounts, endpoint protection, backup, patch management — that map directly to the items in this checklist. Completing this audit honestly will identify gaps that might affect your insurability or your premium, giving you the opportunity to address them before or during the renewal process. However, this checklist does not produce the formal documentation that insurers request; that typically requires completing the insurer’s own questionnaire and, in some cases, providing evidence of specific controls.

How do I know if my current security is adequate?

“Adequate” security is a function of your risk profile, not an absolute standard. A medical practice handling patient records faces higher risk than a landscaping company’s admin system. A business with significant remote access, cloud infrastructure, and sensitive customer data faces higher risk than one with a few in-office devices and no sensitive data. This audit covers the foundational controls appropriate for most small businesses. For a specific regulated industry (healthcare, financial services) or a business subject to specific frameworks (PCI DSS, GDPR, NIS2), additional framework-specific requirements apply on top of this baseline. If in doubt about adequacy for your specific risk profile, consult an IT security specialist or managed security service provider.

For free cybersecurity audit resources, see CISA’s Cybersecurity Assessment resources and the NCSC’s Cyber Essentials guidance for UK businesses. For a full set of cybersecurity policies to support this audit, see our guide to writing a cybersecurity policy for small business.

Related reading on SmallBiz Defense:

• How to Write a Cybersecurity Policy for Your Small Business (2026)
• Best Multi-Factor Authentication (MFA) Apps for Business in 2026 (Reviewed)
• Best Backup Solutions for Small Business in 2026: Cloud + On-Premise (Tested)