Cybersecurity Risk Assessment Checklist

A useful cybersecurity assessment looks beyond antivirus and firewalls. It evaluates how access is granted, how systems are maintained, how users work, how data is protected, and how the organization will recover.

Identity and access

• MFA is required for remote, cloud, and administrative access.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Administrative accounts are separate, limited, and reviewed.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Onboarding and offboarding are documented and timely.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Emergency-access accounts are controlled and tested.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

Endpoints and applications

• Supported operating systems and applications are patched.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Endpoint protection or EDR is deployed and monitored.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Encryption is enforced where appropriate.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Device inventory, ownership, and lost-device response are documented.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

Email and collaboration

• Anti-phishing and malicious-content protections are configured.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• External forwarding and risky sharing are controlled.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Domain authentication and administrative roles are reviewed.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Users receive practical security awareness training.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

Network and remote access

• Firewalls and firmware are maintained.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Guest, IoT, camera, voice, server, and management traffic are segmented where appropriate.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• VPN and remote access require strong authentication.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Internet failover and critical network power are considered.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

Backup and recovery

• Critical data and cloud services are included in the backup strategy.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Backup access is protected and separated where possible.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Representative restores are tested and documented.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Recovery ownership, communication, and priorities are defined.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

Vendors and governance

• Critical vendors, contracts, access, and dependencies are known.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Policies reflect actual practices and responsible owners.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Incident escalation and external contacts are documented.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify
• Leadership receives a prioritized risk and remediation plan.
  StatusNeeds review or improvementMissing / not in placeWant to include or discussAlready covered — verify

This checklist supports readiness and planning; it is not a formal audit or compliance certification.