The 12-Point Security Audit Every Small Business Should Run Today

Most small businesses have more security holes than they think. The problem isn't that security is hard — it's that nobody has shown you what to check.

I've audited dozens of small teams. The same 12 gaps show up every time. Here's the checklist I use, and you can run it in under an hour.

The 12-Point Small Business Security Audit

1. Password Management (5 minutes)

• [ ] Does every team member use a password manager?
• [ ] Are shared passwords stored in the manager (not a Google Doc)?
• [ ] Has anyone reused a personal password for a work account?

Red flag: If anyone says "I just use the same password for everything," you have a breach waiting to happen.

2. Multi-Factor Authentication (10 minutes)

• [ ] Is MFA enabled on your email provider?
• [ ] Is MFA enabled on your cloud storage (Google Drive, Dropbox)?
• [ ] Is MFA enabled on your code repository (GitHub, GitLab)?
• [ ] Is MFA enabled on your payment processor?

One MFA gap = one account takeover away from a business-ending breach.

3. Access Reviews (10 minutes)

• [ ] List everyone who has access to each tool/service
• [ ] Are there former contractors or employees who still have access?
• [ ] Does anyone have admin access who doesn't need it?

4. Data Backup (5 minutes)

• [ ] Where is your customer data stored?
• [ ] Is it backed up automatically?
• [ ] Have you tested a restore in the last 6 months?
• [ ] Could you recover from a ransomware attack without paying?

5. Email Security (5 minutes)

• [ ] Is SPF/DKIM/DMARC configured on your domain?
• [ ] Are team members trained to spot phishing?
• [ ] Is there a reporting process for suspicious emails?

6. WiFi Security (5 minutes)

• [ ] Is your office WiFi using WPA2 or WPA3?
• [ ] Is there a guest network separate from the main network?
• [ ] Has the router password been changed from the default?

7. Device Security (10 minutes)

• [ ] Are all laptops encrypted (FileVault/BitLocker)?
• [ ] Is automatic screen lock enabled (2 minutes)?
• [ ] Are OS updates current on all devices?
• [ ] Is antivirus/EDR installed on all devices?

8. Cloud Configuration (5 minutes)

• [ ] Are S3 buckets / cloud storage set to private?
• [ ] Are API keys rotated regularly?
• [ ] Is there a list of all cloud services in use?

9. Incident Response Readiness (5 minutes)

• [ ] Do you have an incident response checklist?
• [ ] Does your team know who to call during an incident?
• [ ] Have you practiced a tabletop exercise in the last year?

👉 Get the free "First 30 Minutes" incident checklist here — no signup required.

10. Vendor Security (5 minutes)

• [ ] Have you reviewed what data each vendor can access?
• [ ] Are your top 3 vendors SOC 2 compliant?
• [ ] Do you have data processing agreements in place?

11. Physical Security (5 minutes)

• [ ] Are laptops locked when unattended?
• [ ] Is sensitive paperwork shredded, not trashed?
• [ ] Are visitor logs maintained?

12. Security Awareness (5 minutes)

• [ ] Has every team member completed security training this year?
• [ ] Does everyone know how to report a security concern?
• [ ] Is there a security champion on the team?

Scoring Your Audit

Count your unchecked boxes:

• 0-2 unchecked: You're in good shape. Keep it up.
• 3-6 unchecked: You have real gaps. Fix them this week.
• 7+ unchecked: You're at high risk. Start with MFA and password management today.

What to Do Next

1. Fix the easy stuff first: MFA, password manager, access reviews. These take minutes and prevent the most common attacks.
2. Get the free incident checklist: The First 30 Minutes — print it, pin it, share it with your team.
3. Schedule a quarterly review: Security isn't a one-time thing. Run this audit every 3 months.
4. Train your team: The biggest security risk is always human. A 30-minute training session prevents 80% of incidents.

---

Want the full audit template with remediation steps? Check out the Ops Starter Kit — incident response templates, security checklists, and tabletop scenarios for small teams.