Executive Briefing
Assess your technology environment with this self-audit checklist. Identify vulnerabilities, inefficiencies, and opportunities before they become problems.
Security Health Check
- 1Is MFA enabled for all cloud accounts, especially Microsoft 365?
- 2When was your last security awareness training for staff?
- 3Are all systems and applications regularly patched and updated?
- 4Do you have endpoint protection (antivirus/EDR) on all devices?
- 5Are administrative accounts separate from daily-use accounts?
Backup and Recovery
- 1Are all critical data and systems backed up?
- 2When did you last test a backup restoration?
- 3Do you have off-site or cloud backup for disaster recovery?
- 4Is your Microsoft 365 data backed up (separate from Microsoft's retention)?
- 5Do you have a documented disaster recovery plan?
Infrastructure and Operations
- 1Is your hardware less than 5 years old and still supported?
- 2Are operating systems current and receiving security updates?
- 3Do you have monitoring and alerting for critical systems?
- 4Is your internet connection reliable with adequate bandwidth?
- 5Do you have documented IT policies that staff acknowledge?
Scoring Your Health Check
- 12-15 "Yes" answers: Good foundation—focus on optimisation
- 8-11 "Yes" answers: Address gaps before they become problems
- Under 8 "Yes" answers: Significant risk—prioritise security and backup improvements
How We Researched This Article
This article was compiled using information from authoritative industry sources to ensure accuracy and relevance for Australian businesses.
Sources & References
-
→
ACSC Small Business Guide
Australian Government cyber security guidance for small business
-
→
Essential Eight Maturity Model
ACSC baseline security controls assessment
* Information is current as of the publication date. Cybersecurity guidelines and best practices evolve regularly. We recommend verifying current recommendations with the original sources.
Frequently Asked Questions
How often should we do an IT health check? ▼
Formal review at least annually, with ongoing monitoring of key metrics. After significant changes (new systems, office moves, major incidents), conduct targeted reviews.
Should we get an external IT assessment? ▼
External perspectives identify blind spots. Consider professional assessment every 1-2 years, especially if you don't have dedicated IT expertise internally.