How to use this checklist
Record an owner, completion date and evidence for each action. Revisit the checklist after material system changes and at least annually; a tick without evidence is not an effective control.
Why these controls matter
- ✓Online accounts are commonly compromised through stolen passwords and phishing, so multi-factor authentication and staff reporting routes are important.
- ✓Supported software and prompt security updates reduce exposure to known vulnerabilities.
- ✓Backups should cover important data, be tested and be protected from the same compromise as the live systems.
- ✓Everyday users should not have unnecessary administrator privileges.
Checklist
- ✓Inventory devices, software, cloud services, important data and responsible owners.
- ✓Enable multi-factor authentication, use unique passwords and protect administrator accounts.
- ✓Install security updates, remove unsupported software and configure automatic updates where appropriate.
- ✓Configure, monitor and test backups, including restoration of representative files.
- ✓Train staff to recognise and report phishing; maintain a simple incident response contact list.
- ✓Remove leavers promptly and review user, supplier and shared access regularly.
Expected benefits
✓A recorded baseline of essential controls
✓Clear owners for unresolved risks
✓Better preparation for security incidents