Cyber security audit: what a small business should check

Decide what kind of review you need

“Cyber security audit” can mean different things. Agree the purpose before comparing quotes.

• A configuration review examines settings, access, devices and processes against an agreed baseline.
• A vulnerability assessment looks for known weaknesses using an agreed testing method and scope.
• A penetration test attempts to exploit weaknesses under defined rules and written authorisation. It needs appropriately qualified and experienced specialists.
• Cyber Essentials preparation identifies gaps against the scheme’s five technical controls. Preparation does not itself award a certificate.

For certification, use IASME and its licensed certification bodies. For an active incident, use incident-response support rather than waiting for an ordinary audit. The NCSC’s guidance on penetration testing explains why testing scope and provider competence matter.

Why small businesses review their security

In the UK government’s Cyber Security Breaches Survey 2025/2026, 43% of businesses identified a breach or attack in the preceding year. The figures were 42% for micro businesses and 46% for small businesses; phishing affected 38% of businesses overall. These are reported incidents that organisations recognised, not a prediction for any one company.

A review is particularly useful when:

• a customer or tender asks for evidence of your controls;
• staff have left and you are unsure which accounts remain active;
• an IT supplier has changed or access responsibilities are unclear;
• backups have never been restored;
• staff are adopting ChatGPT, Copilot or other tools without agreed data rules;
• a merger, office move or new system has changed what the business depends on.

Start with the question you need answered. “Can we recover our working files?” leads to a different scope from “Are we ready to apply for Cyber Essentials?”

Eight areas to include in a cyber security audit

For every area, record what was checked, what evidence supports the finding and what could not be checked. Missing access should be reported as a limitation, not treated as a pass.

1. Sign-in, MFA and account recovery

List the accounts that would cause the most harm if compromised: email, banking, payroll, cloud storage, website administration and domain registration. Check multi-factor authentication, administrator access and the recovery process for a lost phone or unavailable owner.

Registration for MFA and enforcement of MFA are different checks. Ask whether protection applies to every relevant account and whether legacy sign-in methods or policy exclusions leave gaps. Include accounts used by suppliers, not just employees.

2. Microsoft 365 or Google Workspace settings

Review administrator roles, external sharing, guest access, mailbox forwarding and connected applications. Find out who approves changes and who notices an unexpected sign-in or new forwarding rule.

For Microsoft 365, understand whether the tenant uses security defaults or Conditional Access. Microsoft’s security defaults provide baseline protections, including MFA registration and blocking legacy authentication. Introducing or changing sign-in controls can affect staff and applications, so plan changes with the tenant administrator.

Our Microsoft 365 security audit guide explains the settings to review before a Copilot rollout.

3. Devices, software and updates

Build an inventory of laptops, desktops, phones, tablets, servers and network equipment. Include personal devices that access work systems. Record operating systems, support status, update arrangements and who is responsible for each device.

Check screen locks, everyday administrator use and protection against malicious software. Unsupported software needs a deliberate plan; a device being usable does not mean its vendor still supplies security fixes. The Cyber Essentials requirements include a 14-day deadline for the specified high-risk and critical updates.

4. Backups and recovery

Ask which information the business needs to resume work, where its backup is stored and who can delete it. A copy inside the same compromised account may not provide the separation you expected.

Agree a controlled restore test with the person responsible for the system. Record what was restored, where it was restored and how long it took. Avoid overwriting live data during a test. A successful file restore is useful evidence, but it does not prove that every system or a whole business can be recovered within the same time.

5. Email security and payment checks

Review SPF, DKIM and DMARC with whoever manages your email domain. These controls help address domain spoofing; they do not make every incoming message trustworthy. The NCSC’s email security guidance explains their roles.

Check how staff report suspicious messages and how the business verifies changes to payment instructions. Use a known phone number or another established channel before changing bank details. In the UK, suspicious emails can be forwarded to the NCSC at report@phishing.gov.uk.

6. User access and leavers

Compare current staff and supplier lists with active accounts. Review privileged roles, shared accounts, dormant users and guest invitations. Check whether a change of role leads to a change in access.

Leaver processes should cover sessions, devices, tokens and connected applications as well as passwords. Coordinate account closure with legitimate record-retention and business-continuity needs. Disabling access and deleting business records are different decisions.

7. Suppliers and responsibilities

Your IT provider, web developer and other suppliers may hold important access. Record which accounts they use, why access exists, who approves it and how it will be removed when work ends.

Ask who owns the domain, cloud tenant, backup account and administrator recovery details. The business should be able to establish control even when a supplier normally handles day-to-day administration. Clarify responsibility for updates, alerts and recovery before an incident exposes a gap.

8. AI tools and data controls

List the AI products, accounts, agents and connected applications staff use. Establish which information may be entered, what the provider’s terms allow and which internal files an integration can access. Review the actual business plan and settings rather than assuming that every version of a product has identical protections.

Microsoft 365 Copilot uses existing permissions when working with organisational data. Overshared content can therefore become easier to discover. Review access before connecting more tools, and include agents that have separately granted access to work data.

Our AI policy template helps turn decisions about approved tools, information and responsibilities into rules staff can use.

How this relates to Cyber Essentials

Cyber Essentials assesses five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The current v3.3 requirements apply to assessment accounts created from 27 April 2026.

Start by agreeing scope. Business cloud services cannot simply be left out, and the scope must include end-user devices. A broader review may also cover backups, payment processes, supplier responsibilities and AI use. Those extra topics should not be presented as additional Cyber Essentials controls.

Our Cyber Essentials checklist helps you organise preparation. Certification remains a separate assessment through IASME or a licensed certification body. Passing a configuration review does not guarantee certification or eliminate cyber risk.

What a useful findings report should contain

Ask for a sample report with customer information removed, and agree the deliverables before work begins. A useful report should include:

• Scope and limitations: systems, dates, methods, access supplied and exclusions.
• Evidence: enough information to understand each finding without exposing secrets unnecessarily.
• Business impact: why the issue matters in your environment.
• Priority and owner: which action comes first and who can authorise it.
• Remediation guidance: what should change and how to check the result.
• A follow-up record: fixes completed, items deferred and risks accepted by the business.

A scanner score or a large list of issues is not an action plan. Equally, a short review should not imply complete coverage of systems it did not inspect.

Scope, duration and price: questions to ask

The price and timetable depend on users, devices, sites, cloud services, evidence availability and the depth of testing. Before accepting a quote, establish:

1. Which systems and locations are included, and which are excluded?
2. Who will perform the work, and what relevant experience can they demonstrate?
3. Will the review be observational, or will it include active testing?
4. What access is required, how long will it last and how will it be revoked?
5. How will sensitive findings and evidence be stored, shared and deleted?
6. Are remediation, a findings meeting and a recheck included or separately quoted?
7. Are certification, third-party licences, travel and applicable taxes separate?

Use named accounts and the least access appropriate to the agreed task. Never send passwords, recovery codes or secret keys through an enquiry form or ordinary email.

Free starting points in Northern Ireland and across the UK

The NI Cyber Security Centre provides guidance for smaller organisations. The NCSC offers practical guidance and free tools. These are useful starting points before commissioning specialist work.

If you trade in the Republic of Ireland, also use the Irish NCSC for local guidance and incident information. Whether a UK customer requires Cyber Essentials is a commercial question to establish with that customer.

For immediate practical checks, use our DIY cyber security audit checklist. For the wider priorities, read cyber security for small business.

Discuss the AI side of your security review

Planning AI or Copilot work alongside your security review? Book a free 15-minute call to discuss the project and what needs to be agreed with your IT provider. Please do not send passwords, recovery codes or sensitive business records.

Book a free 15-minute call

FAQ

What is a cyber security audit?

It is a review of systems, settings, evidence and processes against an agreed scope and baseline. Ask the provider to explain precisely what the term covers, which methods they will use and which deliverables you will receive.

Is a cyber security audit the same as a penetration test?

No. A configuration review checks controls and evidence. A penetration test attempts to exploit weaknesses under an agreed scope and written authorisation. Choose the method and provider appropriate to the question you need answered.

Does an audit give us Cyber Essentials certification?

No. It may help identify preparation work, but certification is a separate assessment through IASME or a licensed certification body. Confirm the assessment requirements and scope with the certification provider.

How long does a cyber security audit take?

There is no reliable universal duration. The number of systems, quality of the inventory, access available and depth of testing all matter. Ask for an agreed timetable covering review, findings, any remediation and rechecking.

Can our existing IT provider be involved?

They should be involved where they manage the systems or must approve changes. Establish responsibilities and evidence access before work starts, including who will implement and verify each fix.

Should we share our passwords with an auditor?

Do not send passwords or recovery codes through email or a web form. Agree an appropriate access method with the system owner, normally using named accounts, limited permissions and a defined end date.