Free practical guide
Use this owner-friendly review to expose unclear access, undocumented dependencies and recovery assumptions before they become urgent. It covers the technology, suppliers and working arrangements a small business relies on.
Before you begin
Have recent supplier invoices, administrator details, Microsoft 365 information, backup reports, broadband and phone account records available. Ask the person responsible for day-to-day operations to join the review.
Use three labels: verified when you have seen evidence, assumed when somebody believes it is true, and unknown when ownership or evidence is missing.
The checklist
Write down gaps as you go. Do not enter passwords, recovery codes or other secrets into the checklist.
List the computers, servers, network equipment, cloud services, phone systems and business applications that matter. Record who owns each decision and who can administer each service.
Identify every administrator account. Use named accounts where possible, protect important accounts with 2-step verification and make sure recovery methods belong to the business.
Check active users, licences, shared mailboxes, forwarding, groups and external access. Make joiner and leaver actions repeatable rather than relying on memory.
Confirm that business laptops and desktops run supported software, receive updates and have appropriate protection. Record where business information is stored on portable devices.
Sketch how internet connections, firewalls, switches and wireless access points fit together. Record the broadband account owner, support details and what work stops if connectivity fails.
Record what is backed up, where copies are held, how failures are reported and when somebody last restored important information. A successful dashboard is not the same as a proven recovery.
Document main numbers, call routing, voicemail, handsets and the supplier portal. Check what callers experience when the office loses power, broadband or access to a building.
List the provider, account reference, renewal date and authorised contacts for each important service. Confirm that domains, websites and cloud tenants are controlled by the business rather than an individual or former supplier.
Name the people who make decisions during an outage or suspected compromise. Keep essential supplier contacts and safe alternative communication routes available when normal systems cannot be trusted.
Turn gaps into a short list with an owner and target date. Fix exposed ownership and access issues first, then schedule resilience, documentation and replacement work in a sensible order.
Prompt attention
Record account ownership, service references, dates and responsible people, but keep passwords and recovery codes in an appropriate password manager or other controlled system.
If you suspect an active compromise, do not rely on the potentially affected email or device for response communications.
Before changing supplier
Turn findings into work
Give every action one owner, a sensible target date and an explanation of the business consequence. Deal first with lost ownership, exposed access and unproven recovery. Group lower-risk documentation and replacement work into the next 30 and 90 days.
Official guidance
This broader operational checklist is informed by the UK National Cyber Security Centre’s current guidance for small organisations, including important account protection, device security, backups and incident preparation.
This guide helps a business identify practical questions and ownership gaps. It is not a penetration test, certification, legal opinion, regulatory assessment, formal compliance audit or insurance review.
Common questions
Use it at least annually and after a significant staff, supplier, premises or system change. Important access, backup and continuity actions may need more frequent checks.
No. This is a practical operational checklist, not a penetration test, certification, legal opinion, regulatory assessment or insurance review.
Yes. A capable provider should be able to supply evidence for the services it manages. The business should still understand ownership, dependencies and any areas handled by other suppliers.
Record the gap rather than guessing. Missing ownership, documentation or recovery access is itself a useful finding and should receive an owner and next action.
Need an independent baseline?
Oblyx can gather the evidence, document the complete picture and turn findings into a prioritised working plan.
