You don't need to be an IT expert to ask good questions.
This guide helps identify missing safeguards, unclear responsibilities, and obvious operational risks.
How to use the guide
- Set aside 45–90 minutes with whoever handles computers, accounts, vendors, or office operations.
- Answer all 25 checks. Mark Yes only when you can verify it. Otherwise mark No or Not sure.
- Gather evidence such as settings screenshots, inventories, procedures, or a successful restore test.
- Fix urgent exposures first, then plan remaining improvements over 30 days.
- Repeat the review quarterly and after major staff, software, or office changes.
Know what you own
Unknown devices, accounts, and subscriptions are difficult to secure, support, or budget for.
Can you list every company computer, server, tablet, network device, and its assigned owner?
Can you identify the critical applications, subscriptions, renewal dates, and who administers them?
Are operating systems, browsers, and critical business applications still supported and receiving security updates?
Do you know where business-critical files and customer information are stored, including cloud services and employee devices?
Can you identify who owns the domain name, website, email tenant, business phone numbers, and administrative accounts?
Evidence to look for: device list with model, serial number, owner, location, warranty and last check date; subscription list with provider, purpose, billing owner and renewal; data locations including shared drives, cloud storage, laptops and removable media.
Control access
Account security is often the cheapest place to reduce avoidable exposure.
Is MFA enabled for business email, financial services, remote access, and administrative accounts?
Does each person have their own login rather than sharing one account across staff?
Do employees have only the access required for their roles, with administrator rights restricted?
Is there a documented same-day process to disable accounts, revoke sessions, and recover devices when someone leaves?
Are recovery contacts, backup authentication methods, and emergency admin access documented and controlled?
Safe verification: review sign-in dashboards for MFA exceptions without collecting secret codes; inspect access lists for departed staff and unexplained administrators; walk through a staff exit scenario.
Keep computers healthy
Reliable endpoint management reduces both security risk and everyday disruption.
Are operating-system and major application updates deployed promptly and monitored for failures?
Does every supported business computer have active, centrally monitored security protection?
Are laptops and other portable devices encrypted, with recovery keys securely retained?
Do computers lock automatically and require authentication after inactivity?
Can ordinary users work without permanent local administrator privileges?
Evidence to look for: update status and failed installations, protection dashboard coverage compared with the device inventory, and a controlled process for retrieving encryption recovery keys.
Protect email and backups
A backup is not proven until data has been restored successfully.
Are SPF, DKIM, and DMARC configured and reviewed for the domains you send mail from?
Do employees know how to report suspicious messages and verify unusual payment or account-change requests?
Are critical systems and cloud data included in a documented backup plan?
Is at least one recovery copy protected against routine account compromise, deletion, or ransomware?
Has the business successfully restored representative files or systems within a defined, recent testing interval?
Ask your backup provider: what systems and cloud data are covered, how far back you can recover, and how long restoration would take for the most important business process.
Network, vendors, and people
Good security depends on clear responsibility as much as technical controls.
Are guest Wi-Fi and untrusted devices separated from business systems where appropriate?
Are router, firewall, and Wi-Fi firmware maintained, and are default administrator credentials changed?
Can you identify outside parties with remote or privileged access, and disable access when no longer needed?
Does the team know whom to contact and what to do after a suspected compromise or major outage?
Is one person accountable for technology risk, renewals, policy review, and follow-up on open issues?
Quick tabletop exercise: imagine a ransom note appears and customer records become inaccessible at 9:15 a.m. Decide who responds in the first 15 minutes, who contacts IT and other advisers in the first hour, and which service must be restored first.
What your score means
Mark Yes, No, or Not sure for each of the 25 checks. Only verified Yes responses earn two points, for a maximum of 50. This score is a planning aid, not a measure of breach probability.
Override the score when you find these
Urgent: missing recoverable backups, exposed privileged access, or an active compromise. High: unsupported critical systems.
The downloadable PDF includes a printable 25-item scorecard with space for responses.
Turn findings into action.
Assign each improvement an owner, evidence of completion, and a realistic deadline.
Write down your three most important fixes, the accountable owner, and your next review date. The PDF provides dedicated space for this.
Ask for evidence, not promises.
A good answer identifies a responsible person, a process, when it was last verified, and evidence available to the business.
A little preparation goes a long way
Keep your completed scorecard, inventories, service owners, action plan, and restore-test evidence internally. Share high-level findings selectively, never passwords, recovery codes, or sensitive customer data. Revisit after significant changes or incidents.
Request the printable $0 IT Audit.
The 13-page PDF includes all 25 checks, a printable scorecard, scoring guidance, and a 30-day improvement plan.
Complete the form and HarrisFCS will personally email you a copy. Delivery is manual for now, so it may not be immediate.
Your request does not subscribe you to marketing emails. We use your address to respond to this resource request.
Know what needs attention, but not where to start?
HarrisFCS helps small businesses evaluate technology risks, improve IT operations, and develop practical security plans. No obligation to purchase anything to use this guide.