Sixty percent of small businesses that experience a significant cyberattack close within six months. The threat is not hypothetical and it is not reserved for enterprises. Attackers target small businesses precisely because the assumption that ‘we’re too small to be a target’ means the defences are usually thin.
A cybersecurity audit is not a one-time compliance exercise. It is a systematic review of where your business is exposed and what can be done about it. You do not need a dedicated IT team to run one. You need a framework and the honesty to apply it.
Why Small Businesses Are the Primary Target
Automated attack tools don’t discriminate by company size. They scan IP ranges and probe for open ports, unpatched vulnerabilities, and weak credentials. A bakery with 12 employees and a POS system connected to the internet is as visible to a scanning tool as a Fortune 500 company.
What makes small businesses attractive is the combination of two things: valuable data (customer payment information, personal data, business accounts) and under-resourced defences. Ransomware groups in particular target organisations where the calculus of paying a ransom is close to the cost of recovery.
The 7-Area Security Audit Framework
1. Asset Inventory
You cannot protect what you do not know you have. List every device that connects to your business network: computers, phones, tablets, printers, POS terminals, smart devices. Include cloud accounts, software subscriptions, and email services. This inventory is the foundation of everything else.
2. Access Controls
Who has access to what? Review every user account across your systems. Remove accounts for former employees immediately. Check which staff have admin privileges and reduce these to only those who genuinely need them. Verify that multi-factor authentication (MFA) is active on email, accounting software, cloud storage, and banking.
3. Password and Credential Security
Check that your business uses a password manager and that staff are not reusing passwords across services. The single most common entry point for business compromises is credential stuffing: attackers use leaked usernames and passwords from other breaches to try to access your systems.
4. Software and Patch Status
Check every device and application for pending updates. Unpatched software is the most exploited attack vector after weak credentials. Most exploited vulnerabilities have patches available at the time of the attack. Applying updates within 30 days of release for standard software, and within 7 days for internet-facing systems, eliminates the majority of opportunistic attacks.
5. Data Storage and Classification
Where does sensitive data live? Customer payment data, personal information, employee records, financial data. Who has access to it? How is it backed up? Is it encrypted at rest? Most small businesses discover in this step that sensitive data is less controlled and less clearly located than they assumed.
6. Backup and Recovery
Three questions: Are your critical systems backed up? Where are the backups stored (offsite, cloud, or local only)? When did you last test a restore? A backup that has never been tested is not a backup. It is a hope.
7. Incident Response Readiness
If something goes wrong tomorrow, what happens? Does everyone know who to call? Is there a basic sequence of steps? Does your cyber insurance policy cover the scenario? A simple one-page incident response plan covering the first 24 hours is far better than nothing.
Self-Audit Checklist
| Area | Check | |
| Access Controls | MFA active on email, banking, accounting software | |
| Access Controls | No active accounts for former employees | |
| Access Controls | Admin rights limited to users who need them | |
| Passwords | Business-wide password manager in use | |
| Passwords | No shared or reused passwords for critical systems | |
| Software | All devices checked for pending updates | |
| Software | Antivirus/EDR active on all business computers | |
| Backups | Critical data backed up offsite or to cloud | |
| Backups | Restore tested in last 90 days | |
| Data | Location of all sensitive customer/financial data documented | |
| Incidents | Basic incident response contact list exists |
What to Do With What You Find
Prioritise by risk level. Fix internet-facing vulnerabilities first (open ports, unpatched public-facing software, MFA gaps on external services). These carry the highest immediate exposure. Internal access control issues come next. Documentation and process gaps come after.
Not everything needs an expensive solution. MFA costs nothing on most business services. A password manager costs $3 to $5 per user per month. Removing old accounts costs only time. The highest-return fixes are often the cheapest ones.
How Often to Audit
For most small businesses, a full audit annually is appropriate, plus a lightweight review of access controls and patch status quarterly. After any significant business change (new employee, new software, office move, staff departure) is also an appropriate trigger.
| Expert Tips
1. Don’t buy security tools to replace basic hygiene. A small business with MFA, current patches, and good backup practices is more secure than one with expensive security software but unfixed basics. 2. Your biggest risk is probably credentials, not malware. Fix password practices before buying anything. 3. Cyber insurance is not a substitute for security. Most policies now have minimum security requirements that must be met before a claim is valid. |
