October marks the start of Cybersecurity Awareness Month, a nationwide effort to help individuals and organizations stay safer online. For businesses, it is an ideal time to step back and evaluate whether the fundamentals of cybersecurity are truly in place.
This practical checklist can help business leaders review the controls, policies, and habits that matter most.
Identity and Access
Stolen credentials remain one of the most common ways attackers gain access to business systems. Review the following:
- Is multi-factor authentication enabled for email, remote access, and cloud applications?
- Do employees use strong, unique passwords, ideally managed through a password manager?
- Are administrative accounts limited and separate from everyday user accounts?
- Are accounts removed promptly when employees leave the company?
- Do employees have access only to the systems and data they need?
Devices and Endpoints
Every laptop, desktop, server, and mobile device is a potential entry point.
- Are operating systems and applications updated regularly?
- Is endpoint detection and response installed and monitored?
- Are devices encrypted in case they are lost or stolen?
- Do you maintain an accurate inventory of devices?
- Are unsupported systems scheduled for replacement?
Email Security
Email is still the most common delivery method for phishing and malware.
- Is advanced email filtering in place?
- Are SPF, DKIM, and DMARC configured for your domain?
- Are external emails clearly labeled?
- Do employees have a simple way to report suspicious messages?
Backup and Recovery
Backups are your safety net when something goes wrong.
- Are critical systems and data backed up regularly?
- Are backups protected from ransomware through isolation or immutability?
- Have you tested restoring data recently?
- Do you know how long recovery would take for your most important systems?
Network Security
- Is your firewall updated and properly configured?
- Is guest Wi-Fi separated from the business network?
- Is remote access secured with multi-factor authentication?
- Is network activity monitored for unusual behavior?
People and Training
Technology works best when employees understand their role in security.
- Do employees receive regular security awareness training?
- Do you conduct phishing simulations?
- Do employees know how to verify unusual payment or data requests?
- Does leadership participate in and support security efforts?
Policies and Planning
- Do you have a written incident response plan?
- Does everyone know who to contact during a security incident?
- Are acceptable use, remote work, and AI usage policies documented?
- Have you completed a cybersecurity risk assessment in the past year?
Vendors and Third Parties
- Do you know which vendors have access to your systems or data?
- Are vendor security practices reviewed?
- Is vendor access limited and monitored?
What to Do With Your Results
If you answered “no” or “not sure” to several of these questions, you are not alone. Many businesses discover gaps when they take a closer look. The key is to prioritize. Focus first on the areas that present the greatest risk, such as multi-factor authentication, backups, and endpoint protection, then build a plan for the rest.
Make This Month Count
Cybersecurity Awareness Month is a reminder that security is an ongoing responsibility, not a one-time project. Reviewing these fundamentals now can significantly reduce your risk in the months ahead.
InfoSystems helps businesses assess their security posture and close critical gaps. Contact us to schedule a cybersecurity risk assessment this October.
