Audit-Ready in Under an Hour: A Cyber Hygiene Checklist

Client asking for proof of training? GDPR review coming up? This fast checklist helps small teams get cyber hygiene in order — without a consultant.

🧾 10-Point Audit-Readiness Checklist

1. ✅ Acceptable Use Policy

• Define what’s allowed on work devices
• Include rules for personal use, USBs, and software installs

2. ✅ Security Awareness Training

• Phishing, password hygiene, and device safety
• Quizzes or logs to document completion

3. ✅ Password Hygiene

• Enforce strong, unique passwords
• Require password manager use

4. ✅ Multi-Factor Authentication (MFA)

• Enabled for all cloud and email services
• MFA backup/recovery codes stored securely

5. ✅ Device Auto-Lock & Encryption

• Screen locks after 5–10 minutes
• Full disk encryption turned on

6. ✅ Email Security

• SPF, DKIM, DMARC configured
• Phishing filter and spam quarantine

7. ✅ Incident Response Plan

• Include who to notify, how to respond, and how to report
• Even a 1-page plan helps

8. ✅ Backups

• Offsite or cloud backups tested monthly
• Encrypt backups if they contain sensitive data

9. ✅ Vendor Risk

• Check data-sharing vendors for security compliance
• Use contracts or DPA where needed

10. ✅ Proof of Completion

• Save screenshots, training logs, or email confirmations

“Don’t wait for an audit request — be ready before it arrives.”

🚀 Download a Ready-to-Use Template

The SMBCyberHub kit includes a training log and audit checklist — perfect for onboarding or insurer paperwork.

---

🕒 Estimated Reading Time: 4 minutes
🔐 Aligned With: GDPR Article 39.1(b), ISO27001 Clause 7.2.2