Cyber Security Checklist

All staff use strong, unique passwords (12+ characters) for every account Multi-factor authentication (MFA) is enabled on all email accounts MFA is enabled on cloud services (Microsoft 365, Google Workspace, etc.) A password manager is in use across the organisation Default passwords on routers, cameras and IoT devices have been changed

All devices are running a supported operating system with latest updates Automatic updates are enabled on all work devices Antivirus / endpoint protection is installed and up to date on all devices Devices are locked automatically after a period of inactivity Unlicensed or unsupported software has been removed or replaced

Wi-Fi uses WPA3 or WPA2 encryption with a strong password Guest Wi-Fi is separate from the main business network Router admin password has been changed from the default Remote access to the network is restricted to authorised users only Police CyberAlarm DNS verification record (CNAME or TXT) has been added to your domain

Backups are taken regularly and stored offline or in a separate location Backups have been tested and can be restored successfully Sensitive data is classified and access is restricted to those who need it Data is encrypted on devices and in transit (e.g. HTTPS, encrypted email)

SPF, DKIM and DMARC are configured for your email domain Staff can recognise phishing emails and know how to report them Social media accounts use MFA and have restricted admin access Unnecessary file sharing and auto-forwarding rules are disabled

Devices are locked away or secured when not in use Screen lock is enforced on all devices A cyber security policy exists and staff have read and acknowledged it Leavers are removed from all systems promptly when they leave