The SMB Cybersecurity Audit Checklist: 30 Checks Across 7 Domains (+ Free Template)

In this article:

• What a Cybersecurity Audit Actually Is (and Why SMBs Can't Skip It)
• How to Conduct a Cybersecurity Audit: Scope, Owner, and Cadence
• Domain 1: Network Security and Perimeter Controls (Checks 1–4)
• Domain 2: Identity, Access, and Authentication (Checks 5–9)
• Domain 3: Endpoint and Device Security (Checks 10–14)
• Domain 4: Data Protection and Encryption (Checks 15–18)
• Domain 5: Incident Response Readiness (Checks 19–22)
• Domain 6: Employee Security Awareness (Checks 23–26)
• Domain 7: Compliance and Third-Party Risk (Checks 27–30)
• What Auditors and Insurers Will Ask For
• Get the Free Audit Template
• When to Bring In a Third Party
• Frequently Asked Questions
• Turn Your Audit Findings into a Security Action Plan

TL;DR: A cybersecurity audit is a structured self-check of your security controls, not a penetration test that attacks them. This checklist covers 30 checks across 7 domains: network security, identity and access, endpoints, data protection, incident response, employee awareness, and compliance. Score each check Pass, Needs Improvement, or Fail, assign an owner and deadline to every gap, and repeat at minimum annually. A free scoreable template is included below.

Small and medium-sized businesses are not accidental targets. They are primary ones. According to IBM’s 2025 Cost of a Data Breach Report, the average breach cost reached $4.44 million globally. For an SMB without a dedicated security team, even a fraction of that figure poses a serious operational threat.

The gap is not technical sophistication. It is process. Most small businesses lack a structured, repeatable method for reviewing their security controls before a problem surfaces.

This checklist covers 30 specific controls across seven security domains. Any SMB with an IT manager or an engaged business owner can use it to assess their current posture and know exactly what to prioritize first.

What a Cybersecurity Audit Actually Is (and Why SMBs Can’t Skip It)

A cybersecurity audit is a structured review of your controls, policies, and configurations measured against a defined baseline. Unlike a penetration test, it does not use adversarial techniques to actively exploit weaknesses. And unlike a vulnerability scan, it goes beyond automated tool output to include human interpretation of your actual business risk.

An audit evaluates what you have, how it is configured, and whether that configuration matches what your business actually needs.

Audit vs. Assessment vs. Penetration Test

These terms get used interchangeably. They shouldn’t be:

Start with the audit. It is the cheapest of the four, you can run it yourself, and it tells you where to look before you pay for deeper testing.

The SMB threat environment makes regular audits proportionally more critical, not less. Your organization faces the same threat actors as enterprises: ransomware operators, phishing campaigns, credential-stuffing bots, and supply chain attacks. The difference is that your business almost certainly operates without a dedicated security team to catch what gets through.

Recommended audit cadence: at minimum annually, plus after any major infrastructure change, vendor transition, or confirmed security incident.

This checklist is scoped for organizations with 25 to 250 employees that do not have a full-time CISO or a GRC platform. Every control uses language an IT staff lead, an MSP contact, or a business owner can apply directly. No enterprise tooling required.

How to Conduct a Cybersecurity Audit: Scope, Owner, and Cadence

Before scoring any control, complete these four setup steps. Skipping them produces results that misrepresent your actual risk.

1. Define scope. Specify which systems, physical locations, and user populations are in scope for this audit cycle. Do not exclude systems by default because they seem low-risk. If a system connects to your network, processes business data, or supports a critical function, it belongs in scope.
2. Assign a single owner. The audit needs one accountable person: an IT staff lead, an MSP point of contact, or a compliance officer. Shared ownership produces accountability gaps. If everyone is responsible, no one is.
3. Map your assets before scoring. You cannot audit what you have not inventoried. An asset map covering hardware, software, cloud services, and user accounts is a prerequisite. If your asset inventory does not exist, building it is your first remediation task.
4. Rate and remediate. Score each control as Pass, Needs Improvement, or Fail. For every non-passing item, assign a named remediation owner and a firm deadline. A list of failures with no owner and no deadline is an observation, not an audit.

Domain 1: Network Security and Perimeter Controls (Checks 1–4)

Your network perimeter is the first layer attackers probe. These four checks confirm it is configured, documented, and actively maintained.

• Check 1: Firewall rules reviewed and documented within the last 12 months. Flag any “allow all” outbound rules and any rule untouched since initial setup. Unreviewed firewall rules accumulate over years and create exploitable gaps.
• Check 2: Intrusion prevention system (IPS) or intrusion detection system (IDS) deployed and actively generating alerts. Installed is not the same as active. If your IPS has not produced an alert in 30 days, confirm it is operational, not just present.
• Check 3: Network segmentation separates guest Wi-Fi, operational systems, and any environment storing sensitive or regulated data. A flat network means a compromised guest device has a direct path to your business systems.
• Check 4: All wireless access points enforce WPA2 or WPA3 encryption, with no access point using a manufacturer default credential. Default credentials on Wi-Fi hardware are publicly documented. Attackers do not need to guess them.

Domain 2: Identity, Access, and Authentication (Checks 5–9)

Credential compromise remains the most pervasive technique in confirmed breaches. Per Verizon’s 2026 Data Breach Investigations Report, it appears across nearly 40% of all incidents throughout the full attack chain. Access controls deliver the highest security return on investment of any domain for most SMBs: they stop attacks before those attacks reach your data.

Check 5: MFA enforced on all admin accounts, email platforms, and cloud applications. Multi-factor authentication (MFA) must be enforced, not just enabled. If MFA is optional for any user accessing business email or cloud storage, this check fails. Selective MFA is not MFA.

Check 6: Privileged access reviewed at least quarterly. No dormant admin accounts, no shared service-account credentials. Every account with elevated permissions is tied to a named individual with a documented business need.

The remaining three checks cover the credential environment for all users:

• Check 7: Password policy enforced at the system level with minimum length, complexity requirements, and reuse restrictions. A written policy that the system does not enforce is not a technical control.
• Check 8: Inactive or departed employee accounts disabled or removed within 24 to 48 hours of separation. Orphaned accounts are a persistent, low-effort attack target.
• Check 9: Role-based access control (RBAC) in place so users access only what their role requires. Least-privilege access limits the blast radius of any compromised account.

Domain 3: Endpoint and Device Security (Checks 10–14)

Every managed device is a potential entry point. These five checks confirm your endpoints are visible, protected, and compliant regardless of where they operate.

• Check 10: Endpoint detection and response (EDR) solution deployed on all managed endpoints. Traditional antivirus alone does not satisfy this control. EDR provides behavioral monitoring and active response capabilities that signature-based tools cannot replicate.
• Check 11: Operating systems and third-party software patched and current. Define “current” as within 30 days for critical patches. Unpatched software is among the most common exploitation paths in confirmed breaches.
• Check 12: Mobile devices enrolled in a mobile device management (MDM) platform with remote-wipe capability enabled. A lost phone without MDM enrollment is an unmanaged endpoint with access to your business applications.
• Check 13: A software inventory exists, and unauthorized or shadow-IT applications have been flagged. Every unapproved application is a potential security gap and a break in your patching coverage.
• Check 14: Automatic screen lock and full-disk encryption enabled on all endpoints, including laptops used outside the office. Encryption renders a lost device’s data inaccessible. Screen lock closes the physical access window.

Businesses in the Chicago area often find that ongoing endpoint monitoring and patch management consume more IT time than any other security function. A managed cybersecurity services provider handles both continuously rather than relying on periodic manual checks.

Domain 4: Data Protection and Encryption (Checks 15–18)

Data protection splits across two practical sub-groups: data at rest and data in transit. Both require controls, and this audit covers both.

Data at rest

• Check 15: Full-disk encryption enabled on all laptops and portable drives. Laptop theft is a documented physical breach vector. Without encryption, a stolen device is an open file cabinet.
• Check 16: Encryption verified on database and file-share environments storing sensitive business data. Device-level encryption is not the same as data store-level encryption. Confirm both independently.

Data in transit and cloud storage

• Check 17: TLS 1.2 or higher configured on all web applications and internal services. Older protocol versions carry documented vulnerabilities. Any service still running TLS 1.0 or 1.1 is an unmanaged liability.
• Check 18: Cloud storage permissions audited for public-facing buckets or overly permissive sharing links. A misconfigured bucket has exposed sensitive business data at organizations of every size. Review permissions on a defined schedule, not just at initial setup.

This domain covers business data: customer records, financial data, and employee PII. Personal devices and home-use contexts fall outside the scope of this audit.

Domain 5: Incident Response Readiness (Checks 19–22)

Most SMBs that experience a breach have a response plan somewhere on record. What this audit tests is whether that plan is current, whether the right people know about it, and whether it holds under pressure.

Check 19: A written incident response plan exists and has been reviewed within the last 12 months.

A document in a shared folder that no one has opened since it was created does not satisfy this check. The plan needs a review date, and someone needs to own that review cycle.

Check 20: Incident roles are assigned by name, not just by job title.

“The IT manager” is not an adequate designation when systems are down. Someone specific knows they own breach notification decisions. That person’s contact information is accessible outside your normal systems, including when your email is unavailable.

Check 21: Backup recovery has been tested within the last six months.

Untested backups are assumptions, not controls. Document your recovery time objective (RTO) and recovery point objective (RPO), then verify both with an actual recovery test. A backup that fails during restoration provides no protection. Our free backup and disaster recovery audit tool walks through this domain in deeper detail.

Check 22: A tabletop exercise or incident simulation has been conducted in the last year.

A tabletop exercise tests team decision-making under realistic pressure without requiring an actual incident. It surfaces coordination gaps that no documentation review reveals.

Domain 6: Employee Security Awareness (Checks 23–26)

Your employees are the most frequently tested layer of your security posture. These checks confirm that training is documented, tracked, and connected to a real reporting process. For the user-level habits each staff member should follow, share our employee cybersecurity checklist alongside this audit.

1. Check 23: Security training completion. All employees completed formal security awareness training within the last 12 months. Confirm completion records, not just enrollment. Assigned training that was never finished does not count.
2. Check 24: Phishing simulation. A simulated phishing campaign was conducted in the last six months. Click rates are documented and tracked over time. Training that does not move the click-rate metric is not working.
3. Check 25: Acceptable use policy. All current employees, including recent hires, have signed the organization’s acceptable use policy (AUP) within the last policy-update cycle. A policy no one has signed is not enforceable.
4. Check 26: Incident reporting process. Every employee knows how to report a suspected phishing email or security anomaly. A named contact or ticketing path exists and has been communicated broadly. If an employee would not know what to do when they suspect a threat, this check fails.

Domain 7: Compliance and Third-Party Risk (Checks 27–30)

Regulatory obligations vary by industry:

• HIPAA applies to healthcare-adjacent organizations
• PCI DSS applies to any business that accepts card payments
• The FTC Safeguards Rule applies to auto dealers, tax preparers, and certain financial service firms

Identify which frameworks apply to your organization before scoring these checks.

Check 27: Applicable regulatory frameworks are mapped and documented.

Your organization knows which controls it is required to meet and which it is voluntarily meeting. Undocumented compliance status creates liability in an audit or enforcement action.

Check 28: Audit logs are enabled and retained in compliance with applicable requirements.

Most frameworks specify one to three years of log retention. Logs that are not retained cannot support an incident investigation or satisfy a compliance examiner reviewing your controls.

For vendor and third-party risk:

• Check 29: Third-party and vendor access reviewed at least annually. Every vendor with network or data access is a risk vector. Vendor-caused breaches are a documented and growing category of security incident, per Verizon’s 2025 Data Breach Investigations Report.
• Check 30: Business associate agreements (BAAs) or data processing agreements (DPAs) in place with every vendor handling sensitive or regulated data. A vendor without a signed BAA or DPA handles your regulated data without a documented obligation to protect it.

What Auditors and Insurers Will Ask For

Cyber-insurance carriers and compliance examiners do not take your word for it, they ask for artifacts. Expect requests for: MFA enforcement reports from your identity platform, patch compliance records, dated backup recovery test results, training completion records, signed acceptable use policies, an incident response plan with a documented review date, and retained audit logs.

Every one of those artifacts maps to a check in this audit, that is the point. A passing check with no evidence behind it will not survive an insurance application or an examiner’s review, so capture the artifact as you score each control. Done that way, this checklist doubles as your insurance-renewal prep.

Get the Free Audit Template

The free template packages all 30 checks as a scoreable worksheet — one row per check, with columns for status, remediation owner, deadline, and evidence:

A completed worksheet is your audit record, your remediation plan, and your evidence index in one document.

When to Bring In a Third Party

A self-audit has a built-in limit: you are grading your own homework. The configurations you set up look reasonable to you, that is why you set them up that way, and a checklist review never adversarially validates that a control actually holds.

Bring in a third party when any of these apply: you handle regulated data under HIPAA, PCI DSS, or the FTC Safeguards Rule; you are completing a cyber-insurance application; this checklist surfaced failures across three or more domains; or no one on staff owns security as part of their actual job.

Starting does not require a paid engagement. LeadingIT’s free Cyberscore assessment runs deeper than any checklist: a scored baseline and a prioritized remediation roadmap, produced by people who did not set up your systems.

Frequently Asked Questions

What should a cybersecurity audit include?

At minimum: network and perimeter controls, identity and access management, endpoint protection and patching, data encryption, incident response readiness, employee security training, and compliance with third-party risk review. This checklist covers all seven domains in 30 specific checks, each scored Pass, Needs Improvement, or Fail, with a named remediation owner and deadline for every gap.

How often should a small business do a security audit?

At minimum annually, plus after any major infrastructure change, vendor transition, or confirmed security incident. Several controls need more frequent review than the audit itself: privileged access quarterly, backup recovery tests every six months, and phishing simulations every six months. The annual audit confirms the whole system; the interim checks keep the highest-risk controls current.

What’s the difference between an audit and a pen test?

An audit is a structured review of your controls, policies, and configurations against a defined baseline — it evaluates what you have and how it is configured. A penetration test uses adversarial techniques to actively exploit weaknesses and prove they are reachable. Run the audit first: it is cheaper, you can do it yourself, and it tells you where to look before paying for offensive testing.

Is there a free cybersecurity audit template?

Yes. The free template in this article packages all 30 checks as a scoreable worksheet with columns for status, remediation owner, deadline, and evidence. Download it above. If you would rather not self-audit at all, LeadingIT’s free Cyberscore assessment produces a scored baseline and a prioritized remediation roadmap for your specific environment.

Turn Your Audit Findings into a Security Action Plan

Completing this checklist gives you a prioritized picture of your security posture. When the gaps it surfaces are systematically closed, your team operates with fewer disruptions. Controls become documented and predictable, and your organization can explain its security posture to customers or auditors without scrambling to compile evidence.

LeadingIT provides managed IT and cybersecurity services to businesses across the Chicagoland area, including security assessments, endpoint protection, policy reviews, and ongoing monitoring. For organizations that want a professional assessment rather than a self-guided checklist, the Cyberscore assessment produces a scored baseline and a prioritized remediation roadmap tailored to your specific environment.

Schedule a free Cyberscore assessment to get an objective view of your security posture, or call 815-788-6041 to speak with the team.