IT Security Checklist
Check off each control as you confirm it is in place. Gaps become your action list.
1 - Identity and Access Management
Multi-factor authentication (MFA) on all accounts MFA is enabled on Microsoft 365, Google Workspace, banking, and any system accessible from outside the office.
Password manager in use All staff use a business password manager (e.g., Keeper, 1Password, Bitwarden). No shared sticky-note passwords.
Minimum password length of 14 characters enforced Password policy is set via Active Directory, Entra ID, or Google Admin and enforced automatically.
Admin accounts are separate from daily-use accounts Staff do not log in as domain admins for day-to-day work. Higher-level access is used only when needed.
Least-privilege access enforced Users only have access to the files, systems, and applications required for their role.
Offboarding checklist exists and is followed When an employee leaves, their accounts are disabled within 24 hours. Email forwarding, device recovery, and access removal are documented.
Shared/service accounts are inventoried All shared logins (e.g., reception@, admin@) are documented and reviewed at least annually.
Access review completed in last 12 months User access rights were reviewed to confirm no former employees or unnecessary access remains active.
3 - Endpoint and Device Security
EDR (Endpoint Detection and Response) on all devices All company computers run a business-grade EDR solution (e.g., SentinelOne, Microsoft Defender for Business), not basic consumer antivirus.
Full-disk encryption enabled BitLocker (Windows) or FileVault (Mac) is enabled on all laptops and desktops. Recovery keys are stored securely off-device.
Automatic OS updates enabled Windows Update or macOS auto-update is configured to install security patches within 30 days of release.
Screen lock set to 10 minutes or less All devices lock automatically after a short idle period. Staff cannot disable this policy.
Company devices inventoried You have a current list of all company-owned computers, laptops, tablets, and phones, including make, model, serial number, and assigned user.
Mobile Device Management (MDM) in place Company-owned and/or BYOD devices used for work are enrolled in an MDM solution (Intune, Jamf, etc.) for remote wipe capability.
USB ports restricted on sensitive systems Employees cannot copy data to USB drives on servers or systems handling sensitive data.
End-of-life devices identified and replaced You know which computers are running unsupported operating systems (e.g., Windows 10 end-of-life: Oct 2025) and have a replacement plan.
4 - Network and Firewall Controls
Business-grade firewall in place You have a dedicated firewall (Cisco, Fortinet, Sophos, etc.), not just a consumer router, protecting your network perimeter.
Guest Wi-Fi is separate from staff Wi-Fi Clients, visitors, or personal devices connect to a guest SSID that cannot reach internal servers or workstations.
VPN required for remote access to internal systems Staff accessing on-premise servers, files, or internal apps from outside the office must connect via VPN.
Firewall firmware updated in last 6 months Network equipment (firewall, switches, access points) firmware is patched regularly and vendor support is current.
DNS filtering enabled DNS filtering (e.g., Cisco Umbrella, Cloudflare Gateway) blocks access to known malicious domains before a connection is made.
RDP (Remote Desktop) not exposed to the internet Remote Desktop Protocol is not accessible directly on port 3389 from the public internet. Access is behind VPN or a jump server.
Network diagram exists and is current A diagram of your network layout (servers, switches, Wi-Fi, internet link) was updated within the last 12 months.
6 - Software and Patch Management
Software inventory is maintained You have a current list of all software installed across company devices, including version numbers.
Third-party software is patched regularly Applications like browsers, Office, Adobe Reader, and Java are updated within 30 days of a security patch release.
Unsupported software removed or isolated Software that no longer receives security updates (e.g., Windows 7, Office 2013) has been removed or isolated from the network.
Staff cannot install unauthorized software Standard user accounts cannot install software without IT approval, reducing the risk of accidental malware installation.
Patch management tool or process in place Patches are tracked and applied systematically, not ad hoc. This can be an RMM tool, WSUS, Intune, or a documented manual process.
Server OS patches applied within 30 days On-premise servers running Windows Server or Linux receive security updates within 30 days of release.
7 - Staff Security Awareness
Security awareness training completed in last 12 months All staff completed a formal security awareness training program covering phishing, social engineering, and safe data handling.
Phishing simulation tests conducted Staff are tested with simulated phishing emails at least twice per year to measure and improve awareness.
IT Acceptable Use Policy (AUP) in place A written policy exists covering acceptable use of company devices, internet, email, and data. All staff have signed it.
New employee IT security orientation completed New hires receive IT security briefing as part of onboarding, covering passwords, phishing, reporting, and acceptable use.
Incident reporting process is known by all staff Every employee knows who to contact and what to do if they suspect a security incident, click a phishing link, or lose a device.
8 - Compliance and Documentation
Written information security policy exists Your organization has a documented security policy covering data classification, access control, and acceptable use.
Incident response plan documented You have a written plan for responding to a breach, ransomware attack, or data loss, including contacts, steps, and notification obligations under PIPEDA.
Third-party vendor security reviewed Vendors and service providers with access to your data or systems have been reviewed for their security posture (SOC 2, ISO 27001, or equivalent).
Annual security review scheduled A formal IT security review is scheduled at least once per year to assess gaps, review policies, and update controls.
Not sure how to close your gaps?
If you have more than a few unchecked items, our team can help. We work with BC businesses to implement the controls above on a flat monthly rate.
