A practical small-business cybersecurity assessment covering critical assets, identity, websites, cloud services, backups, vendors, and incident readiness.
Inventory what keeps the business operating
List domains, websites, email, cloud platforms, payment or customer systems, business profiles, repositories, devices, and third-party services. Record the owner, administrator, recovery contact, data sensitivity, and operational impact of loss. This inventory does not need to be a perfect enterprise database; it needs to reveal the accounts and dependencies whose failure would stop work or damage trust.
Secure identity before adding more tools
Most small teams depend heavily on a few administrator accounts. Enable strong multi-factor authentication, remove former users, avoid shared credentials, review recovery methods, and keep emergency access controlled. Use separate accounts for administration and daily work where practical. A security product cannot compensate for an attacker who can reset the domain, email, cloud, and business accounts through one poorly protected identity.
Review public systems and common failure paths
Check updates, dependencies, exposed services, TLS, headers, authentication, forms, uploads, APIs, secrets, and deployment configuration within an authorized scope. Examine how customer data enters, where it travels, and who can access it. Active testing needs permission and boundaries. The objective is to find meaningful risk without destabilizing a live system or collecting unnecessary sensitive data.
Test backups as a recovery process
A backup is useful only when it is recent enough, isolated from the incident, and restorable within the time the business can tolerate. Identify systems that require backup, retention, encryption, and recovery owners. Perform a controlled restore test and document the sequence. Include domain, configuration, and credential recovery—not only application files—because those dependencies often determine actual downtime.
Account for vendors and integrations
Website plugins, marketing tools, payment services, contractors, cloud providers, and shared drives extend the attack surface. Record what each provider can access, how permissions are granted, how incidents are communicated, and how access is removed. Reduce dormant integrations and broad API keys. Vendor reputation matters, but configuration and lifecycle ownership remain the customer's responsibility.
Prioritize remediation and rehearse response
Rank findings by likely business impact, exploitability, exposure, and fix dependency. Assign an owner and acceptance check to every priority item. Create a short incident plan covering who can disable access, preserve evidence, contact providers, communicate internally, and restore service. A concise plan rehearsed once is more useful than a long policy nobody can locate during an incident.
