// Free IT hygiene checklist
Free IT security checklist for small businesses
Sixteen questions on the security basics every business should have, whatever your industry. About five minutes, with a scored report and suggested fixes sent by email.
The IT Hygiene Baseline is where to start if you’re not sure which rules apply to you, or if none do. It checks the fundamentals that stop most everyday attacks, and it’s the foundation every compliance framework builds on.
What the checklist covers
- Identity and access. Everyone has their own login, multi-factor authentication protects email, remote access, and admin accounts, and accounts are shut off the day someone leaves.
- Devices. Managed antivirus or EDR on every device, patching that’s current, no operating systems past end of life, and disk encryption on laptops, desktops, and servers.
- Data and backup. Automatic backups of everything that matters, one copy off-site and out of reach of everyday logins, and a restore tested in the last 12 months.
- Network. Nothing like remote desktop exposed to the internet, and remote access only through a VPN or zero trust with MFA.
- People. Security awareness training at least once a year.
- Operations. Monitoring and alerts for servers, backups, and disk space.
- Resilience. A written incident response plan with named contacts, and cyber-liability insurance in force.
Where to look first
If you can only fix three things this month, make them MFA everywhere it’s offered, a backup copy that ransomware can’t reach, and a restore you’ve actually tested. Our multi-factor authentication checklist walks through the first one in detail.
After the checklist
Your report shows your score and a suggested fix for every gap. Use it however you like. If you’d like help, these are the things we set up and look after every day as part of managed IT support. And if a specific law or contract applies to you, take the matching checklist next: NIST CSF, HIPAA, PCI DSS, GDPR, or LGPD.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation.
// Questions
Common questions
We're not regulated. Do we still need this?
Yes. Attackers don't check whether you're regulated. These basics are also what cyber insurers ask about, and what any later compliance framework will build on.
Is this the same as a NIST CSF assessment?
No. IT Hygiene is a shorter, vendor-neutral baseline. The NIST CSF checklist covers the same ground plus governance, planning, and vendor oversight.
How long does it take?
About five minutes for 16 questions. If you don't know an answer, choose Not sure. That tells you something too.
// Next step
Want help closing the gaps?
Most of these basics are things we set up and look after every day. A consultation turns your report into a short, prioritized plan.