Cybersecurity Readiness Checklist for SMEs
This 20-question self-assessment measures how prepared a small or growing business is to prevent, detect and recover from common cyber incidents. Answer yes or no to each question, count your "yes" answers, and use the score guide to see where to focus first. It takes about ten minutes and needs no technical knowledge.
Section A: Accounts and access
- ☐ Multi-factor authentication is turned on for all email accounts.
- ☐ MFA is turned on for online banking, accounting and payment platforms.
- ☐ Staff use a password manager, or unique passwords for every work account.
- ☐ Everyday work is done from accounts without admin rights.
- ☐ When someone leaves, their access is removed the same day.
Section B: Devices and software
- ☐ Computers and phones install security updates automatically.
- ☐ Every work laptop has endpoint protection (modern antivirus) and disk encryption.
- ☐ We can remotely lock or wipe a lost work device.
- ☐ We know every device and cloud service that holds company data.
Section C: Email and data
- ☐ Our domain has SPF, DKIM and DMARC configured.
- ☐ Email can't be automatically forwarded to outside addresses.
- ☐ Files are shared with specific people, not "anyone with the link".
- ☐ We know where our customer and employee personal data is stored.
Section D: Backup and recovery
- ☐ Critical data is backed up automatically.
- ☐ At least one backup copy is offline or can't be altered.
- ☐ We've successfully tested restoring from backup in the last six months.
Section E: People and response
- ☐ Staff have had phishing awareness training in the last 12 months.
- ☐ Any request to change bank details or make an urgent payment is verified by phone using a known number.
- ☐ We have a written plan for what to do in a cyber incident, including who to call.
- ☐ We know our legal duties to report a breach (for example to the NDPC within 72 hours in Nigeria).
Your score
| "Yes" answers | Readiness | What it means |
|---|---|---|
| 17–20 | Strong | Good foundations. Focus on testing, monitoring and regular review. |
| 11–16 | Developing | Some important gaps. Fix any "no" in Sections A and D first. |
| 0–10 | At risk | Common attacks would likely succeed. Start with MFA, backups and updates this week. |
Any "no" on questions 1, 14, 15 or 18 is urgent, whatever your total score. These four gaps account for many of the costliest incidents businesses suffer: account takeover, ransomware without a recovery option, and payment fraud.
What to do next
- Score 0–10: follow Priority 1 in our 12 essential controls guide.
- Using Microsoft 365 or Google Workspace: see the settings to turn on.
- Holding personal data in Nigeria: check the NDPA compliance checklist.
- Want an expert view: a cybersecurity risk assessment goes deeper than any self-assessment.
Frequently asked questions
How accurate is a cybersecurity self-assessment?
It's a useful starting point, but it relies on what you know about your own systems. A professional assessment checks configurations directly and often finds gaps that aren't visible from the inside.
How often should we repeat this checklist?
Every six months, and after any significant change such as new systems, rapid hiring or an office move.
Which items should we fix first?
MFA on email (question 1), offline and tested backups (questions 15–16), and payment verification (question 18). They're low-cost and prevent the most damaging incidents.
Want a professional review?
Eleova's cybersecurity risk assessment starts from $499 for businesses with up to 25 staff. Talk to our security team →