IT Security Checklist for Businesses

All access to critical systems (email, VPN, cloud, ERP) requires a second authentication factor.

Each employee only has access to the systems and data strictly necessary for their job. No shared accounts.

Access for employees who changed roles or left the company is reviewed and revoked. No orphan accounts.

Minimum 12-character passwords, no forced expiration but verification against leaked password databases (Pwned Passwords).

Mandatory use of a password manager (1Password, Bitwarden, Keeper) for all employees. Password reuse forbidden.

All computers and servers have an active, updated Endpoint Detection and Response (EDR) system.

All corporate laptops and mobile devices have encrypted disks (BitLocker, FileVault, LUKS).

Operating systems and critical applications update automatically. Critical security patches deployed in under 72 hours.

All devices lock automatically after 5 minutes of inactivity and require a password to unlock.

Employees can only install software from approved sources. Unsigned file execution blocked.

Only strictly necessary ports are open. Rules reviewed quarterly.

Employee, server and guest networks are separated in VLANs with explicit access rules between them.

All remote access to the corporate network requires VPN with multi-factor authentication. No direct RDP from the internet.

Traffic monitored for anomalous patterns: suspicious IP connections, unusual data transfers, internal port scans.

WiFi uses WPA3 or WPA2-Enterprise (802.1X) with per-user authentication. Guest network fully isolated.

3 copies of data on 2 different media with 1 offline/immutable copy outside the corporate network. Backups tested quarterly.

Written and tested document describing how to restore critical systems in under 48 hours after a major incident.

Data classified by sensitivity level with specific access controls and encryption per level.

Data deleted when no longer needed according to documented retention policy approved by legal.

All internet-exposed web applications and APIs receive professional pentesting at least annually and after major changes.

Continuous integration pipeline includes SAST, SCA and secret detection before reaching production.

All internet-exposed web applications protected by a Web Application Firewall with updated rules.

CSP, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy correctly configured.

Annual training on identifying phishing emails, smishing and vishing. Periodic phishing simulations.

Written document detailing who does what, when and how during a cyberattack. Tested with drills at least annually.

Security of suppliers accessing company data or systems is assessed. Contracts include security requirements.

Employee onboarding includes role-based access. Offboarding revokes all access within 4 hours.

Records of processing activities, DPIA where needed, and a channel to exercise data subject rights.

Company complies with cybersecurity regulations applicable to its sector and size.

An independent external company audits security at least annually. Findings prioritized and remediated.