1. Check how people sign in
Start with business email and the cloud services you use for documents, invoicing and customer records. Ask whether extra sign-in protection is enabled, and who owns the recovery methods.
Use individual staff accounts where practical. When someone leaves or changes roles, review their access. If you use Microsoft 365 or Google Workspace, some settings need administrator permission. Do not change them without an agreed plan.
2. Look at updates and device protection
On the computers you depend on, check the update status rather than assuming automatic updates have completed. Look for pending restarts and unsupported software. Check that device protection is enabled and review any warnings.
Make a simple device list so a rarely used laptop is not forgotten. Coordinate updates around work and confirm your important software will continue to function.
3. Test a small recovery
Write down which information you could not afford to lose: current invoices, client records, job files or accounting data. Compare that list with your actual backup coverage.
With appropriate permission, restore a non-sensitive test file to a separate location. Check that it opens and that the date is useful. Keep the original file intact. A successful test of one file is a starting point, not proof that every system can be recovered.
4. Review access to customer information
Where do your customer records live? Who can open them? Check shared folders and cloud links, especially links that may permit broad access. Staff should have the access needed for their work, rather than every account having full control.
This is a practical access review. It does not establish compliance with all privacy or industry obligations. Specialist advice may be appropriate for regulated or sensitive information.
5. Agree what happens if something looks wrong
Staff should know who to tell about an unexpected sign-in prompt, suspicious email or missing file. Keep important supplier and IT contact details accessible through a trusted channel.
For an unexpected payment request, verify it independently before acting. If an incident occurs, record what happened and seek appropriate help. Do not rush into deleting files or restoring backups before understanding the problem.
Turn checks into a short action list
Assign an owner and a sensible review date to each concern. Start with the accounts and information that matter most to your work. You do not need a long technical document to make useful progress.
A Cyber Security Check-Up can bring relevant checks together and explain priorities in a report where your package includes reporting.
Further reading
For broader guidance, see these official resources:
General information, not a complete assessment of your environment. Provider settings and instructions can change.