The small business cyber security audit checklist

Self-audit vs. a professional audit

A cyber security audit for a small business can mean two different things, and mixing them up wastes time. The first is a self-audit: you, or whoever handles IT, work through a checklist — password policy, backups, patching — and fix the gaps you find. It costs nothing but time, and it catches the obvious stuff: shared logins, no 2FA anywhere, backups nobody has ever tested, an ex-employee who still has admin access to the CMS.

The second is a professional audit — someone actually testing your systems the way an attacker would, not just confirming a control exists. For anything you expose to the public internet, your website in particular, that means a manual penetration test rather than an automated scan. Both matter. This guide is built around the first, with pointers to the second wherever a checklist question can’t tell you the real answer.

Where NIST’s guidance fits in

If you want a formal framework behind this checklist, NIST runs a Small Business Cybersecurity Corner with free, plain-language resources built specifically for companies without a dedicated security team — it’s a credible starting point and worth bookmarking. CISA publishes similar small-business guidance. Neither replaces the practical, run-it-this-week version below; they’re reference material for when you want to build a fuller written policy.

These six areas cover the large majority of how small businesses actually get compromised. None of them require specialized tools — a spreadsheet and an afternoon get you through most of it the first time.

• Passwords and 2FA everywhere. Every login your business depends on — email, bank, domain registrar, hosting, CMS, payroll — should have a unique password and 2FA, ideally an authenticator app rather than SMS. The registrar and hosting account are the two most commonly overlooked, and the two that do the most damage if compromised.
• Patching and update cadence. Set an actual cadence — critical patches within 48 hours, routine updates monthly — and name one person responsible for each category.
• Backups — existence and a tested restore. A backup nobody has restored is a hope, not a control. Test restores quarterly, not once and never again.
• Access control — who has admin on what. Former employees, old contractor accounts, and “everyone’s an admin because it was easier” are the three most common findings here.
• Employee phishing awareness. Teach staff to check the sender’s actual email address, to verify unusual requests through a second channel, and to report suspicious emails to one specific person.
• Your public-facing website. The one item generic checklists almost always gloss over — the system an attacker can reach without any inside access at all.

A realistic cadence: quarterly self-check, annual professional test

Run through this checklist quarterly — it takes an afternoon once you’ve done it the first time. Add a professional check on a longer cycle: annually at minimum, and immediately after any major change — a new website launch, a platform migration, a payment processor switch, or after you’ve let go of anyone who had administrative access.

Writing it down — a lightweight policy beats no policy

You don’t need a 40-page document to get value from writing this down. A one- or two-page summary stating your password and 2FA requirement, your patch cadence, who owns backups and access reviews, and what staff should do if they suspect phishing is enough to turn the checklist into a habit instead of a one-time exercise.

What a checklist can’t tell you

A checklist tells you whether a control exists — 2FA is on, backups run nightly, plugins are updated. It can’t tell you whether those controls actually hold up against someone trying to get past them, or whether there’s a gap the checklist never thought to ask about: a login form that leaks whether an email address is registered, an API endpoint with no authentication, a forgotten staging subdomain running an old, vulnerable build. Those are the findings that show up in an actual manual test and never show up on a self-audit.

What a manual audit actually adds

Bug Circuit runs manual penetration tests — a human security engineer actually tests your site by hand, rather than running an automated scanner and handing you the raw output. For a small business, the $49 Circuit tier is a one-time audit with a written report: each finding comes with its severity, the evidence, and the exact steps to fix it. The $299 Signal tier adds the team fixing the high and critical issues with you, re-testing, and watching for three months. Every engagement requires you to verify you own the domain and sign an Authorization to Test first.