The 27-point IT security checklist (and why most businesses fail it)

Every cybersecurity assessment we run starts the same way: a 27-point checklist covering passwords, network setup, email security, backups, data handling, and physical security. It's not exotic. Most of it is basic hygiene. And most businesses we assess only tick about half of it.

Why the basics get skipped

Nobody sets out to leave their business exposed. It happens gradually: a router password that was never changed after setup, a laptop that was never patched because nobody was assigned to do it, a backup that was configured years ago and never tested since. None of these decisions feel risky in the moment. Together, they add up to a business that's one bad afternoon away from a serious problem.

The five categories that matter most

Passwords and access control catch the most points, mostly because multi-factor authentication still isn't switched on by default for a lot of businesses. Network and device hygiene comes next: unpatched software and flat, unsegmented networks are still extremely common. Email and phishing readiness matters because most incidents start with a click, not a hack. Backups get checked properly, meaning restored and tested, not just assumed to be running. And data and compliance rounds it out: knowing what you hold and why, not just having a privacy policy nobody's read since it was published.

What to do with a low score

A low score isn't a verdict, it's a to-do list. Most of the fixes are cheap and fast: changing a default password takes minutes. A few take longer, like documenting your network or setting up proper backup testing. The point of the checklist isn't to shame anyone into a full security overhaul. It's to make the invisible visible, so you can decide what to fix first.

You can download the full checklist for free and work through it yourself, or book a free review and we'll go through it with you.