Small business security audit checklist: the 45-point walkthrough

Filed under security · pairs with the server hardening checklist and the MFA rollout checklist

Most small teams have never run a security audit, and the reason is not laziness — it is that "audit" sounds like a six-week engagement with consultants in suits. It is not. An audit is a checklist you walk in a day, with evidence for every line, producing a scored list of findings you can fix over the next month. This page is that checklist: 45 points across six zones, a day-long schedule for running it, a scoring rule that forces prioritization, and the one-page report format that makes the results actionable instead of shelved.

1. What an audit is — and is not

Three words get used interchangeably and mean different things:

An audit is the cheapest of the three and the one that makes the other two possible: you cannot harden what you have not measured, and you should not pay for a pentest until the checklist is mostly green.

2. The six zones

Every point below belongs to a zone. The zone framing matters because audits fail when they wander: one person checks "whatever feels risky" and the estate's biggest hole (usually identity) never gets counted. Walk the zones in order — identity first, because most real breaches start with a credential, not a firewall.

1. Identity & access — who can reach what, with what, and since when.
2. Devices — the laptops and phones that hold the data.
3. Network — the perimeter, such as it is in 2026.
4. Data & backups — where the bytes live and whether recovery actually works.
5. Vendors & SaaS — the third parties that hold your data under their names.
6. Incident readiness — what happens in the first hour after something goes wrong.

3. The 45 points

Each line is pass/fail. The evidence rule is absolute: screenshot or it did not happen. A point you "believe" is fine is a finding, not a pass.

Zone 1 — Identity & access (10 points)

• 1.1 MFA is enforced (not optional) on every identity provider — email, code repos, cloud console, accounting.
• 1.2 No shared logins for any service; if one exists, it is a finding.
• 1.3 Admin accounts are separate from daily-use accounts for every human.
• 1.4 A complete list of who has admin rights exists and was reviewed within 90 days (see the access review checklist).
• 1.5 Departed employees and ex-contractors have zero active accounts — check every leaver from the last 12 months.
• 1.6 Password manager is deployed to 100% of staff, and zero passwords live in browsers, notes files, or spreadsheets.
• 1.7 Service accounts and API keys are inventoried, owner-named, and rotated on schedule (the key rotation checklist is the pass bar).
• 1.8 Break-glass account exists: two emergency credentials in a sealed envelope or vault, tested this year.
• 1.9 Session timeouts: email and cloud consoles log idle sessions out within a day.
• 1.10 OAuth grants (apps users connected to company data) were reviewed and pruned this quarter.

Zone 2 — Devices (7 points)

• 2.1 Full-disk encryption is on for 100% of laptops (FileVault/BitLocker) — verify, do not assume.
• 2.2 Screen locks: 5 minutes or less, password required, on every machine.
• 2.3 OS auto-updates are on everywhere; no device is more than one major version behind.
• 2.4 An asset inventory exists and matches reality: every laptop, phone, and NAS is on the list (the asset inventory template is the format).
• 2.5 Lost-device response is defined: remote wipe available and someone is authorized to fire it.
• 2.6 No company data on personal USB drives; when it must travel, it travels encrypted.
• 2.7 Default passwords on printers, cameras, and NAS boxes have been changed (printers are computers too — see the printer checklist).

Zone 3 — Network (6 points)

• 3.1 The router/firewall firmware is current and the default admin password is gone.
• 3.2 Guest WiFi is isolated from the corporate network.
• 3.3 Inbound port-forwards are inventoried; every one maps to a named reason and an owner.
• 3.4 Remote access runs through a VPN or an identity-aware proxy — not exposed RDP/SSH (the VPN checklist is the bar).
• 3.5 DNS filtering is on for the office network and, ideally, the laptops themselves (the DNS filtering checklist).
• 3.6 Nothing faces the internet that does not need to: check the cloud consoles for public buckets, open databases, forgotten test servers.

Zone 4 — Data & backups (8 points)

• 4.1 A written backup schedule exists and covers: file shares, code repos, cloud SaaS exports, and databases.
• 4.2 Backups run automatically and their success is monitored (a backup nobody checks is a rumor).
• 4.3 At least one backup copy is offline or immutable — ransomware cannot reach it.
• 4.4 A restore test happened in the last 90 days with real evidence: a file restored, timing noted (the restore test drill is the format).
• 4.5 The recovery point objective is written down: how much data loss is acceptable, in hours.
• 4.6 The recovery time objective is written down: how long until the business works again.
• 4.7 Shared drives follow least-privilege: no "everyone" folder holding payroll or contracts (the file share permissions audit finds these).
• 4.8 Sensitive data is enumerated: where customer PII lives, who can export it, and where it leaves.

Zone 5 — Vendors & SaaS (8 points)

• 5.1 A SaaS inventory exists: every tool that holds company or customer data, with its owner (the SaaS sprawl audit finds the unknowns).
• 5.2 Each vendor holding sensitive data has had a lightweight security review (the vendor security review questions).
• 5.3 Email authentication is correct: SPF, DKIM, DMARC at enforcement (the SPF/DKIM/DMARC checklist).
• 5.4 Vendor access to your systems is via named accounts, not a shared login someone left in a ticket.
• 5.5 Offboarding data deletion is written into the key vendor contracts, and at least one departing vendor's data was actually deleted this year (the vendor offboarding checklist).
• 5.6 Card payments and invoicing flows have the fraud controls on (the BEC/invoice fraud checklist).
• 5.7 Cyber insurance requirements are mapped to reality: every attestation the policy assumes is actually true (the insurance requirements checklist).
• 5.8 Shadow IT sweep done this quarter: unmanaged tools found and either adopted or retired (the shadow IT audit is the sweep).

Zone 6 — Incident readiness (6 points)

• 6.1 Someone is named on-call for a security incident, and their out-of-band contact path is tested.
• 6.2 The first-30-minutes plan exists and has been read by more than one person (start with the free First 30 Minutes card).
• 6.3 A one-page incident response plan exists with severity levels and escalation names (the IR plan template).
• 6.4 Log retention is decided: what is kept, for how long, and where (the log retention policy).
• 6.5 A tabletop exercise ran in the last six months, and its failure points produced at least one fix (see the tabletop failure points).
• 6.6 Ransomware recovery is a written sequence, not a hope (the ransomware recovery checklist).

4. Running it in one day

Two-person version: one person walks the checklist, one runs the consoles. A solo auditor self-deceives twice as fast.

5. Scoring and the one-page report

Score every point 0 (fail), 1 (partial), 2 (pass). Zone scores out of 20 give you the shape of the problem; the total out of 90 gives you the trend to beat next audit. But the number that matters is the critical count:

• Critical = an attacker would use it this month (no MFA on email, working backup never restore-tested, public storage bucket, shared admin login). Fix within 7 days.
• High = attacker would need luck. Fix within 30 days.
• Hygiene = matters at audit time, not at midnight. Batch quarterly.

The report is one page, three columns: Finding → Risk in one sentence → Fix + date + owner. No vulnerability scores, no essay. The report exists to get fixes scheduled, and the hardening checklist is where the fixes go to die properly — each finding becomes a line there.

6. When to bring in an outside pair

Run the internal audit first — always. It is cheap, it teaches the team the estate, and it removes the findings you never needed help to see. Outside help earns its fee in exactly two situations:

• The critical count stays above eight after your own fixes, or the fixes need sequencing you do not have time to design. That is what a prioritized external audit is for: findings ranked, fix plan attached, five-day turnaround (we run one — the Small-Team Ops Audit, fixed fee, no lock-in).
• The fear is incidents, not compliance: an audit finds gaps, but the artifact a small team actually uses at 2am is a runbook. Where the audit says "incident readiness is the weak zone", a done-for-you incident runbook built from your findings beats a 40-page policy PDF (see the Custom Incident Runbook, 48-hour delivery).

Everything else on this checklist is deliberately self-serve. The gap between a checklist and an engagement is usually just sequencing.

7. Five numbers to track after the audit

• Criticals open > 7 days: target zero. This is the only audit number a founder needs to see.
• Restore-test success: last drill passed, with the file name and timing recorded.
• MFA coverage: percentage of human accounts with MFA enforced — target 100%, no exceptions list.
• Leaver-offboarding completeness: departed staff with zero active accounts, checked against every leaver.
• Findings fixed per month: velocity beats completeness; a shrinking backlog is the trend that matters.

Where this fits

The audit is the snapshot; the daily work lives in the patch management checklist and the password manager rollout. The findings feed the hardening checklist and the file share permissions audit. When an audit finding is "we would not survive Tuesday", the Ops Starter Kit is the shortest path from zero to a working incident response If you would rather have an outside pair run the walkthrough and write the fix plan, that is the audit-and-runbook service; and the report the walkthrough produces has its own format — see the security audit report template; and if the question is what the outside version costs, the honest tiers are in the security audit cost guide; and if you want to score yourself right now, the interactive audit scorecard runs the same 45 points in your browser.

If you are booking an outside audit, a day of preparation changes what it finds — the audit preparation checklist assembles the packet, pre-closes the cheap findings and shortens the walkthrough.

From the HIVE80lab kit

• The First 30 Minutes — free incident quick-start
• Ops Starter Kit — full incident-response kit for small teams — $14
• Small-Team Ops Audit — prioritized findings + fix plan, five-day turnaround — $149
• Custom Incident Runbook — done-for-you, built from your estate, 48h — $249
• Ops Mega Bundle — all 5 kits in one download — $29