Cybersecurity Checklist

What a cybersecurity inspection is

A cybersecurity inspection is a structured review of the controls that protect your organization's systems, facilities, and information. Rather than waiting for an incident, you walk through each control area and record whether it is in place, missing, or not applicable to you. The result is a documented picture of where you are exposed and what needs attention. This checklist covers eight areas: the inspection itself, personnel, physical security, account and password management, confidential data protection, disaster recovery, security awareness, and compliance. It contains 64 questions, each answered Yes, No, or N/A. The point is to assess and document the status of your security controls, so that you can act on the gaps rather than assume there are none.

Why it matters

Threats that succeed do not just compromise data: they disrupt operations. A stolen laptop, a former contractor who still has an access badge, a hard drive sold on with its contents intact, or a disaster plan nobody has tested can each halt the work your organization depends on. The checklist is built around prevention and protection. Physical access to computer areas, the way staff authenticate, how sensitive data is classified and encrypted, and whether backups can actually be recovered are all part of the same picture. Left unexamined, each of them is a single point of failure.

What a good inspection covers

**Physical security and personnel.** Confirm that staff identification badges are current, show a photo, and identify the access level and type of holder, that external contractors' credentials are verified, and that background checks are covered by policy. Access to computer areas should be controlled through a single point, a reception desk, sign-in and sign-out, or temporary visitor passes, with visitors escorted. Policies should cover how access to facilities and information systems is cut off when an employee or contractor leaves, and how unauthorized physical access is prevented. Equipment should be positioned away from public areas, protected, secured against being left logged in, and locked automatically after 10 minutes of inactivity. Laptops need their own protection, such as cable locks or secure storage, and modems should have Auto Answer switched off. **Accounts and passwords.** Policies and standards should cover electronic authentication, authorization, and access control for personnel, systems, applications, and data. Only authorized personnel should reach your computers. Password methods should be required and enforced, and the passwords themselves should be difficult to guess, changed regularly, and never temporary or default. Staff should be able to enter passwords without others seeing them. **Confidential data.** Classify your data so that sensitive and non-sensitive information are distinguishable, and exercise your responsibilities over the sensitive data you hold. The most valuable or sensitive data should be encrypted. Policies should cover retention in both hard copy and electronic form, the handling of credit card information, and the handling of private personal information. **Disaster recovery.** You need a business continuity plan, a process for creating recoverable backups and copies of critical files, and a communications plan for emergencies and incidents. The communications plan should identify who to notify, their contact details organized by incident type, who makes the contacts, who speaks to the press or public, and how employees and their families are kept informed. Emergency procedures should be implementable by the responsible individuals when needed, and your evacuation plan should be current, identifying the areas and facilities that must be sealed immediately and ensuring key personnel know how to seal them. **Security awareness.** Staff should receive computer security information and training on a regular and recurring basis. They should be taught to watch for potential breaches, to use strong passwords, and to identify and protect classified data whether it sits in paper documents, removable media, or electronic files. Awareness should extend to the proper handling of credit card data and private personal information such as names, addresses, phone numbers, and social security numbers. **Compliance.** Review your security documents on a regular basis and audit your processes and procedures against the policies and standards you have established. Test your disaster plans regularly, and have management periodically review who holds physical access to sensitive facilities and electronic access to information systems.

How to carry out the inspection

Work through the checklist one section at a time, answering each question Yes, No, or N/A, and use the inspection details at the start to record when it was conducted, who prepared it, and where. Answer honestly; a tidy set of 'Yes' answers that does not reflect the building, the badge printer, or the backup logs is worse than no record at all. Treat every 'No' and every 'N/A' as a decision to make rather than a box to skip. For 'No', write down what would close the gap, whether that is a policy, a procedure, a configuration change, or a physical measure, and give it an owner. For 'N/A', note why it does not apply. Where a control depends on people, test it rather than assuming it. Check that screens lock, that Auto Answer is off, that backups restore, and that the people named in the communications plan know they are named. Once the inspection is complete, set a date to repeat it and to review whether the gaps you recorded have actually been closed.

Frequently Asked Questions

Wipe decommissioned drives before disposal, and use recognised destruction methods such as shredding CDs and DVDs, electronically wiping drives, or burning tapes so that hardware and electronic media are rendered unusable and inaccessible. Waste paper should be shredded rather than thrown in the trash, and shredding bins should be locked.

Yes. The checklist calls for training on a regular and recurring basis, and expects employees to be taught to be alert for potential security breaches, to use strong passwords, to protect classified data across paper documents, removable media, and electronic documents, and to handle credit card data and private personal information correctly.

You cannot use it as proof of a specific certification, but you can use it to assess and document the status of your security controls, audit your processes and procedures against your own established policies and standards, and periodically review your security documents. It covers eight areas: inspection details, personnel, physical security, account and password management, confidential data protection, disaster recovery, security awareness, and compliance.

The checklist uses a Yes, No, and N/A scale, so where a control does not apply to your environment, record N/A and note why. Anything marked No becomes a finding to address, along with the policy, procedure, or configuration change that would close it out.

It spans the security controls that could disrupt operations, from physical protection of computer areas to authentication and access control, sensible data classification and encryption, backups, emergency communications, and regular review of whether the controls still work. Use it as a working inspection record, then revisit it as systems and staffing change.

No. It helps you assess and document the status of your security controls and test whether your disaster plans still hold up, but it is not a substitute for legal or regulatory advice, and it does not certify your organization.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile