Reviewed 25 October 2026.
.svg){kind=small}
.webp)
A cyber security audit should leave you with a clear answer to three questions: what could interrupt the business, what evidence shows your controls work, and what needs fixing first?
A list of software licences cannot answer those questions. Neither can a green dashboard on its own. The useful work is checking how accounts, devices, data and suppliers actually behave, then giving each finding an owner and a way to verify the fix.
This guide is for UK small-business owners and operations teams preparing an internal review or commissioning specialist help. It includes a cyber security audit checklist, practical data-hardening checks and a finding record you can copy. It is a preparation guide, not a certification assessment or a substitute for testing by a suitably qualified specialist.
In this guide: agree the scope, work through the checklist, harden business data, record and prioritise findings, and compare audit proposals.
For this guide, a cyber security audit means an evidence-based review of agreed systems and controls against stated requirements. Those requirements might come from your own security policy, a customer contract or a defined standard. The report should say which it used.
It should distinguish a control that works, a control that failed and a control the reviewer could not verify. “Not tested” must remain visible. Otherwise a small sample can be mistaken for assurance over the whole business.
Several services sit beside an audit, but answer different questions:
An audit can recommend hardening and specialist testing. It should not quietly present a scan as a penetration test, or a general checklist as Cyber Essentials certification.
Start with the services the business cannot afford to lose: email, customer records, payments, payroll, scheduling, the website and the documents needed to deliver work. Name the systems that support them, including cloud services and supplier-managed accounts.
Write a short scope covering:
Use named, time-limited access with the permissions the reviewer actually needs. Agree a secure way to share evidence. Passwords, recovery codes and secret keys do not belong in an enquiry form, emailed report or shared spreadsheet.
For each area, record the system, date, evidence, sample size, exceptions and owner. A policy describes the intended control; a configuration export shows a setting; a practical check shows what happened in a particular test. Keep those types of evidence distinct.
List devices, software, online services, domains and important information stores. Include personal devices used for business, old applications still holding data and systems managed by a supplier. Every critical service needs a business owner and an identifiable administrator.
Evidence to request: a dated asset register, support contacts, renewal ownership and the systems included in the review. The NCSC's asset-management guidance is a useful starting point.
Practical check: choose one important process, such as issuing an invoice, and trace every system it needs. If the register misses a dependency, fix the register before claiming complete coverage.
Review who has access, why they need it and whether the permission level matches their work. Check former employees, temporary staff, guests, supplier accounts and unattended integrations. Everyday work should not depend on unrestricted administrator access.
Evidence to request: current account and role exports, the last access-review date and a sample of completed leaver actions. Follow the NCSC's guidance on important online accounts.
Practical check: trace one recent leaver through email, cloud storage, the customer system and relevant supplier portals. Disabling one login does not demonstrate that every independent account or integration was dealt with.
Check whether strong sign-in protection is enforced for the people and accounts that need it. “Multi-factor authentication is available” is weaker evidence than a policy showing who is covered and which exceptions remain. Review account recovery as well as normal login.
Evidence to request: enforcement settings, registration or coverage reports, exceptions and recovery ownership. The NCSC recommends passkeys where supported, or strong unique passwords with two-step verification.
Practical check: have an authorised administrator explain what happens if a key staff member loses their phone. Check that recovery is usable without giving a single person permanent, unreviewed control of the business.
Check operating systems and applications are supported, updates are reaching devices, and endpoint protections are active. Review screen locks, local administrator rights, unnecessary applications and services, and relevant firewall settings. Include laptops that rarely connect to the office.
Evidence to request: device inventory, software versions, update status and configuration exceptions. Use the NCSC device guidance alongside the vendor's current baseline.
Practical check: compare a small, recorded sample of actual devices with the management report. Investigate missing or stale devices. Plan and test configuration changes before applying them across the whole business.
Identify sensitive information and examine who can read, change, download or share it. Look beyond the main application to exported spreadsheets, shared links, email attachments and old folders. A cloud provider's encryption does not settle whether your own sharing permissions are appropriate.
Evidence to request: a data map, a sample of permissions and external links, guest-access reviews and documented retention decisions.
Practical check: choose a sensitive folder and trace the routes by which an ordinary user or external guest could reach it. Use an authorised test account and non-sensitive sample material where possible. The next section turns those findings into data-hardening work.
Confirm what is backed up, what is excluded and whether the business can restore it. The NCSC advises keeping an independent copy of critical cloud data, rather than relying solely on version history or deleted-file recovery.
Evidence to request: backup coverage, access controls, failure alerts and a dated restore record. Agree how much lost work and downtime the business can tolerate, then compare the test with those needs.
Check whether a compromised everyday account could also delete or alter the backup copies. The NCSC's ransomware-resistant backup guidance explains why backup access and deletion protection need separate attention.
Practical check: restore representative data into a safe location and have its owner check completeness and usability. Record missing records and dependencies. A successful backup job and a successful restore are different results.
List the providers and integrations that can access business information or change records. Check which permissions each connection holds, who approved them and whether they are still needed. Include automation platforms, website plugins and AI tools.
Evidence to request: an approved supplier list, connected-app permissions, integration owners and relevant support or incident contacts.
Practical check: choose one workflow and explain what it can read, send or change. If it uses someone's personal account, establish how ownership, support and eventual access removal will work. Our Power Automate governance guide covers this in more detail.
Check that useful records exist, that someone can access them and that important alerts reach a person who knows what to do. The NCSC's logging and monitoring guidance explains why collecting logs without a usable response process is insufficient.
Evidence to request: a log sample, retention settings, alert ownership and a short incident contact sheet. Keep an accessible copy of essential contacts outside the system that might become unavailable.
Practical check: walk through a fictional lost laptop or compromised mailbox. Who makes the first decision, contacts the supplier and records actions? The NCSC's free Exercise in a Box can support a safe discussion exercise.
“Data hardening” is a practical description, not a separate certification. Here it means reducing unnecessary access, copies and exposure while keeping important information accurate and recoverable. It sits alongside system hardening, which focuses on the configuration of devices, applications and services.
For personal data, the ICO's security guidance calls for protection appropriate to the risk and checks that the measures remain effective. This checklist does not establish full UK GDPR compliance. The ICO currently flags that guidance is being reviewed following changes in UK data law.
Start with one dataset, such as customer contact details. Where is its authoritative version? Where does it get copied: a CRM export, a reporting workbook, an email attachment, a test database, an automation log or an AI document store?
Record the purpose and owner of each copy. A restricted source system provides limited reassurance if a weekly export sits in an unrestricted folder. Our data-mapping guide provides a structure for tracing information through a workflow.
Ask the data owner which roles need access and what they need to do. Review organisation-wide links, public links and guest access separately. Confirm the replacement route works before removing a shared link that customers or colleagues genuinely use.
For example, a finance team may need the full invoice dataset while a weekly operations report only needs job status and totals. Produce the narrower report instead of distributing the full export to everyone.
Review protection for data on devices, in storage and in transit. Include recovery-key ownership and the people permitted to recover encrypted data. The ICO's encryption guidance explains both its value and its limitations.
Encryption does not stop a compromised account reading information it is authorised to access. Keep permissions, account security and recovery arrangements in the same review.
Agree how long information is needed and why. Include exports, test data and records stored by suppliers. Do not apply an invented universal retention period or delete records subject to contractual, legal or investigation requirements.
The ICO's storage-limitation guidance explains the need to justify retention and review information that is no longer required. Record the decision, the deletion process and any exceptions.
A useful hardening result has two sides: inappropriate access is blocked, and authorised work still succeeds. Check both. Re-run the relevant report, integration or restore test and record the result.
For AI-connected information, review what the tool can retrieve and what actions it can take. Keep detailed Copilot permissions, prompt-injection and approval controls in the separate enterprise AI security guide.
A report is only useful if someone can act on it. Copy this record into your own tracker for each finding:
Finding and affected system:
What was observed, and where?
Evidence and date:
What proves it, and what was sampled?
Business consequence:
What could be exposed, changed or interrupted?
Priority and owner:
Who accepts the risk and who implements the fix?
Agreed action and deadline:
What will change, and what dependencies must be checked?
Verification:
What result will show the fix works, who checks it, and when?
Status:
Open, mitigated, verified closed or explicitly accepted with a review date.
Prioritise using the impact, exposure, ease of misuse and existing safeguards. An exposed administrator account deserves a different response from an incomplete policy heading. Active compromise needs incident handling rather than a place in a routine backlog. Record temporary controls when a permanent fix must wait.
During a review, an authorised tester finds that a customer export can be opened by anyone with its sharing link. The file contains information not needed by the wider team. This is an illustration, not a Blue Canvas client incident.
The last check matters. Fixing one file without correcting the process can recreate the same problem next week.
A useful price depends on scope. One cloud tenant and a small device fleet are different from several sites, a bespoke application and multiple suppliers. Ask for the systems, sampling, manual review, specialist tests, report, explanation call and retesting to be priced clearly.
Before accepting a proposal, ask:
A long scanner export is not the same deliverable as a checked, prioritised action plan. Compare what will be verified and explained, rather than the number of pages promised.
This is a suggested work sequence, not a compliance deadline or a promise that every business can finish in a month. Bring urgent findings forward.
Repeat relevant checks when staff, suppliers, applications or permissions change. Treat vulnerability management as ongoing work; the NCSC's guidance covers identification, prioritisation and remediation.
You can prepare the inventory, document ownership and collect authorised evidence. Bring in specialist help where technical testing, independence, contracts or certification require it. Do not run intrusive tests on a supplier's systems without explicit permission.
No. Microsoft Secure Score helps identify recommended actions and track configuration work. It does not cover every exposure or guarantee protection. Review the underlying controls, exceptions and business impact instead of chasing a number alone.
No. The eight areas here cover a broader internal review, including data handling, recovery and response. Cyber Essentials has its own defined scope and current requirements. Use the official assessment resources when preparing for certification.
Blue Canvas helps businesses in Northern Ireland, Great Britain and Ireland map workflows, connect systems and put practical controls around AI and automation. If your concern is what an integration can access, where an AI workflow sends information or who owns it after handover, bring that specific workflow to the conversation.
We can discuss the scope and whether it needs specialist security assessment alongside implementation work. Our AI audit is a separate service for assessing business workflows and AI opportunities; it is not a penetration test or security certification.
Book a free consultation with Blue Canvas. Describe the business concern without sending passwords, secret keys or sensitive customer records.
Published 25 October 2026. Prepared by Blue Canvas using the NCSC, ICO and Microsoft sources linked throughout. Check current vendor and scheme guidance before implementing changes.
Talk to Blue Canvas. Bring one task that takes too long.
In a free 15-minute call we will tell you whether AI can help, and what a sensible first step would cost.
.svg){kind=small}
.svg){kind=small}
