An owner should not have to learn an entire security profession to ask useful questions about the business. You do need a way to distinguish a protection that exists from a protection everyone assumes exists.
Use this checklist as a conversation starter. For each area, record the owner, what you checked, and the next action. “We probably have that” belongs in the unknown column.
Know what the business depends on
List the systems that keep the work moving: email, dispatch, billing, shared files, devices, and the internet connection. Include the vendor or person who controls each one.
NIST’s small-business guidance treats cybersecurity as an ongoing risk-management job. An inventory and clear responsibility make that job more concrete. Start with the process that would hurt most if it stopped tomorrow. You can expand the list after the first useful review.
Check who can get in
Ask how people receive access, recover it, and lose it when their role changes. Include administrative accounts and shared services. Confirm multifactor authentication where appropriate, and identify accounts that still depend on one person’s phone or inbox.
The business test is simple: can an authorized employee cover an absence without borrowing another person’s identity? Can you remove a departing employee’s access without losing the records they managed? If either answer is uncertain, document the gap.
Check whether maintenance is happening
Identify who keeps devices and applications supported and updated. Ask how device protection is monitored and who handles alerts. A subscription or a green icon is only part of the evidence.
Pick a few representative devices and verify the intended process. An employee’s rarely used travel laptop may reveal a gap that the office desktop does not. The useful result is a maintenance owner and a method, not a list of products.
Test recovery and reporting
Choose a harmless file and verify the recovery process into a separate location. Record who can restore it and how long the test takes. Also ask employees where they would report a suspicious email or a missing device.
- Name the first person to contact.
- Keep a backup contact outside the affected system.
- Record the minimum details needed to describe the problem.
- Make it acceptable to report uncertainty early.
A recovery plan hidden inside an inaccessible account is not ready for the day you need it.
Finish with three priorities
Do not leave the review with twenty equally urgent projects. Pick the highest-impact unknown or gap, one practical improvement, and one recurring check. Assign each an owner and a date.
This is a starting checklist, not certification or a guarantee. Its value is making the next decision clearer. Security becomes more manageable when the business can say what is known, what needs attention, and who will move it forward.