Annual IT and Cybersecurity Health Check for SMEs

Every year, business leaders review revenue, costs and growth plans. Far fewer review the IT and security that the whole business runs on. Not because they’re careless, but because preparation doesn’t feel urgent when nothing is broken.

In our experience working with SMEs, the difference between prepared and unprepared businesses isn’t budget, tools or industry. It’s that prepared businesses check their assumptions regularly instead of trusting them. An annual IT and cybersecurity health check is the simplest way to do that.

This guide gives you a practical health check you can run once a year, at the start of the calendar or financial year, in about half a day with your IT provider.

Ask Better Questions Than “Are We Secure?”

“Are we secure?” invites a yes or no answer that’s rarely true. Prepared businesses ask more useful questions:

• How exposed are we today, compared with last year?
• What would hurt us most if it stopped?
• How quickly could we actually recover, and when did we last prove it?
• What has changed this year: new staff, systems, suppliers or ways of working?

The health check below turns these questions into specific things to look at.

The Annual IT and Cybersecurity Health Check

Work through each area and mark every item as done, partly done or not done. The checks follow the same areas as our minimum security baseline.

1. Accounts and access

• MFA is turned on for every email, admin, banking and cloud account
• Accounts for staff who have left are disabled
• Admin rights are limited to the people who need them, and staff don’t use local admin accounts day to day
• Shared passwords have been changed, and a password manager is in use
• Access to finance, HR and customer data is limited to the right people

2. Devices

• You have an up-to-date list of every PC, laptop, server and phone used for work
• All devices are running supported operating systems, with nothing past end of support
• Security updates are installed automatically and on time
• Every device is protected by managed endpoint security with EDR
• Laptops are encrypted and can be locked or wiped remotely if lost

3. Network and remote access

• The firewall is business-grade, supported and its firmware is up to date
• Guest Wi-Fi and devices such as printers and CCTV are separated from the main network
• Remote access uses a VPN or secure method with MFA, not open remote desktop
• Router and firewall default passwords have been changed

4. Email and Microsoft 365

• Email security filters phishing, malware and spoofed emails
• SPF, DKIM and DMARC are set up for your domain
• Microsoft 365 security settings have been reviewed, including sign-in alerts and external sharing
• No unexpected email forwarding rules or third-party app permissions exist
• Microsoft 365 data (email, OneDrive, SharePoint, Teams) is backed up separately

5. Backup and recovery

• Backups follow the 3-2-1 backup rule, with one copy offsite and protected from ransomware
• Backups are checked for success every day or week, not assumed
• A full restore has been tested in the last 12 months, and you know how long it took
• Recovery times match what the business needs for each critical system

6. Data protection and PDPA

• A data protection officer (DPO) is appointed and their contact details are published
• You know where personal data is stored and who can access it
• Old personal data that’s no longer needed has been deleted
• Files aren’t shared with “anyone with the link” unless necessary
• There’s a process for handling a data breach

7. People

• All staff have had cybersecurity awareness training this year, including new joiners
• Staff know the one channel for reporting suspicious emails or mistakes
• Bank detail changes are always verified by phone
• Phishing simulations or real examples have been shared with the team

8. Plans and suppliers

• Your incident response plan is up to date, with current names and phone numbers
• Your business continuity plan reflects this year’s systems and priorities
• A tabletop exercise has been run in the last 12 months
• You’ve reviewed what each IT supplier does for you, and what they don’t
• Cyber insurance, if you have it, matches your current setup and its requirements are being met

How Often Each Check Should Happen

The annual health check is a review. Some of these tasks need to happen much more often in between.

What to Do With the Results

1. List every item marked “not done” or “partly done”.
2. Rank them by impact: what would hurt the business most if it were exploited or failed. MFA, endpoint protection and tested backups usually come first.
3. Assign an owner and a date for each fix.
4. Budget for the bigger items while this year’s plans are still being set.
5. Repeat next year and compare. Progress you can see is easier to explain to management, customers and insurers.

If the health check shows you need new tools or services, our guide on How to Choose a Cybersecurity Solution for Your SME helps you avoid buying the wrong thing.

Why the Start of the Year Is a Good Time

At the start of the year, or your financial year, budgets are still flexible, priorities are still being set and there’s time to plan calmly. Once the year gets busy, preparation tends to be postponed until an incident forces it, when it’s more expensive and stressful.

Prepared businesses choose readiness before something forces the decision. Unprepared businesses are forced to decide under pressure. The outcome is rarely the same.

How Ostendo Can Help

As an Acronis Gold Service Provider holding CSA’s Cyber Essentials mark, Ostendo can run the health check with you, explain the results in plain language and help fix the gaps, with Acronis Endpoint Security, Acronis Backup, Microsoft 365 Backup and day-to-day IT support.

Eligible SMEs can get up to 50% grant support for Acronis Endpoint Security, Acronis Backup and Microsoft 365 Backup. See our EDGE grant guide.

Frequently Asked Questions

What is an IT health check for a small business?

It’s a structured review of your accounts, devices, network, email, backups, data protection, staff awareness and plans, to find security gaps and outdated systems before they cause problems.

How often should an SME do a cybersecurity review?

A full health check once a year, with smaller checks in between: backups daily or weekly, updates monthly, restore tests and account reviews quarterly.

Who should carry out the health check?

A business owner or manager working with your IT provider. The manager knows what matters to the business, and the IT provider can check the technical settings.

What are the most common gaps found in SME health checks?

MFA not on every account, old accounts not removed, devices past end of support, basic antivirus instead of managed EDR, untested backups and no written incident plan.

Does a health check help with Cyber Essentials or cyber insurance?

Yes. It covers many of the same areas as CSA’s Cyber Essentials and the questions insurers ask, so it’s a useful starting point for both.

Book Your Health Check

WhatsApp Ostendo on +65 9457 3538 to arrange an IT and cybersecurity health check for your business, or download our Cyber Resilience Checklist below to start on your own.