AMDigitec InsightsKey takeaways
- Ten practical checks that cover the protections that matter most.
- Most can be reviewed in an afternoon, without specialist tools.
- Tick what you have, note what you don’t, and fix the gaps in order.
Security advice often arrives as a hundred-item framework that nobody finishes. This cybersecurity checklist is the opposite: ten checks, in plain language, that cover the gaps attackers exploit most often. You do not need to be technical to work through it.
How to use this cybersecurity checklist
Go through each check and answer honestly: yes, no or not sure. Anything marked no or not sure is worth fixing, and the order below roughly follows the impact each one has.
Protect your accounts
1. Multi-factor sign-in is on for email and remote access
Stolen passwords are behind a large share of break-ins. A second step at sign-in stops most of them.
Start here: confirm it is required for every mailbox, starting with leadership and finance.
2. Administrator accounts are separate and few
Everyday accounts with full administrator rights turn a single mistake into a full compromise.
Start here: list who holds administrator rights, and remove any that are not needed.
3. Staff leave with their access
Former employees with working accounts are an open door.
Start here: check that accounts are disabled on someone’s last day, every time.
Protect your email and data
4. Your domain is protected against spoofing
Without SPF, DKIM and DMARC, criminals can send email that appears to come from you.
Start here: ask whoever manages your domain to confirm all three are in place.
5. Backups exist and have been restored
A backup that has never been tested is a hope, not a plan.
Start here: ask when a restore was last tested, and test one file this week.
6. Sensitive files are shared securely
Email attachments and personal file-sharing accounts are hard to control once sent. Here is why a client portal beats email for sensitive documents.
Start here: agree one approved way to share sensitive files with clients.
7. Software is kept up to date
Known weaknesses in outdated software are one of the most common ways in.
Start here: confirm updates are applied automatically where possible.
Get AMDigitec Insights by email
Protect your people and processes
8. Payment changes are verified by phone
Fake requests to change banking details are a leading cause of losses. They usually start with business email compromise.
Start here: make a rule: every banking change is confirmed by calling a known number.
9. Your team knows what an attack looks like
People are involved in most breaches, by email, phone or text.
Start here: share one real example of a fraudulent request with your team this month.
10. You know who to call if something goes wrong
In an incident, the first hours matter, and confusion costs time.
Start here: write down who to contact, including your bank, and keep it somewhere everyone can find it.
If you answered no or not sure to three or more checks, you are not alone, and the fixes are usually practical. The order above is a sensible place to start.
When to get a second pair of eyes
A checklist tells you what to look for. It cannot always tell you whether something is actually configured correctly. If you would like these checked properly, an IT & Security Assessment verifies how your systems are really set up and gives you a written plan for what to fix first.
Common questions
Which checks should we fix first?
Start with multi-factor sign-in, tested backups and phone verification of payment changes. Together they stop the most common and most costly losses, and none of them needs a large budget.
Is this checklist enough on its own?
It covers the essentials, which is where most risk sits. A professional assessment verifies the details a checklist cannot.
How often should we go through it?
Once a quarter is a good rhythm, and again whenever you add new systems, staff or suppliers.