Business cyber security review checklist
A useful cyber security review connects your business risks to the controls and people responsible for them. Prepare the scope and questions below before discussing managed security or Cyber Essentials readiness with SCG Solutions.
Decide what the review needs to answer
Start with the reason for the review: a customer requirement, a supplier change, an insurance question or an identified weakness. List the systems, users, locations and third parties involved, then name the person who can approve changes. Do not describe the entire business as reviewed if important systems remain outside the agreed scope.
A planning discussion is different from a technical assessment, penetration test or certification. Ask what evidence will be examined, what deliverable you will receive and which activities need separate authorisation. Never commission active testing against systems you do not own or have permission to assess.
Bring evidence for accounts, devices and recovery
The NCSC small-organisations guide covers protecting email, online accounts and devices, backing up data and spotting attacks. Use those headings to organise your existing evidence: who has access, which devices are supported, how data is backed up and how people report a suspicious message.
For the review conversation, bring inventories and the dates of previous checks rather than passwords or raw customer data. Ask which gaps need urgent action and which need a planned project. The initial meeting should establish the next checks, not claim that the business is secure from a questionnaire alone.
Sources for this section: NCSC — small organisations guide to cyber security
Ask how managed security operates in your environment
If discussing Huntress managed EDR, Check Point network security or Microsoft 365 controls, ask where the proposed service applies and what it does not cover. Record supported devices, licence assumptions, administrator responsibilities and the changes needed to deploy it. A product name is not a complete security design.
Agree who receives alerts, who can authorise containment and how an incident is escalated outside normal hours. Ask how the proposed service fits with existing tools and how exceptions are recorded. Monitoring, responding and restoring operations are separate responsibilities; make all three visible in the agreed scope.
Separate Cyber Essentials readiness from certification
Cyber Essentials is built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus assesses the same controls with additional independent technical testing. Use the current scheme requirements and agree the assessment scope before gathering evidence.
SCG Solutions can discuss readiness and remediation requirements. That is not a claim that this review awards certification or that SCG Solutions is an NCSC-assured assessor. Certification is a separate assessment process through the scheme’s authorised route, and completing a checklist does not guarantee a pass.
Sources for this section: NCSC — Cyber Essentials
Choose the outcome you need
Match the brief to the decision, rather than treating every security activity as the same service.
| Need | Useful evidence | Confirm in the scope |
|---|---|---|
| Understand current gaps | Systems, users, existing controls and known issues | Evidence reviewed, prioritised actions and accountable owners |
| Deploy managed security | Endpoint inventory, network layout and existing tools | Coverage, licences, alert handling and response responsibilities |
| Prepare for Cyber Essentials | Assessment scope and current control evidence | Readiness work, remediation and separate certification arrangements |
Your cyber security review checklist
Prepare scope and evidence without sharing credentials or sensitive data in a public form.
- State the business reason for the review and the intended deliverable.
- List systems, users, locations and third parties in scope.
- Identify the owner for Microsoft 365, devices and network administration.
- Gather existing control records and note where evidence is missing.
- Document backup scope, recovery ownership and previous test dates.
- Agree alert handling, containment authority and escalation contacts.
- Separate readiness support from certification or active testing.
- Assign owners, priorities and follow-up dates to the agreed actions.
Related services and next steps
Business cyber security review checklist — common questions
Is a cyber security review a penetration test?
Not automatically. A review may examine scope, controls and evidence. Active technical testing is a separate activity requiring an explicit scope and permission. Confirm the deliverable before commissioning work.
Does managed EDR replace firewalls or Microsoft 365 security?
Treat these as different parts of a security design. Discuss endpoint coverage, network boundaries, identity controls and response responsibilities together rather than assuming one product covers every risk.
Does this review give us Cyber Essentials certification?
No. Readiness support and remediation are separate from certification. Use the current scheme requirements and its authorised assessment route; a planning discussion or checklist does not award a certificate.
Prepare your security conversation
Tell SCG Solutions why you are reviewing security, the sites and systems involved and whether you need managed protection or certification readiness. Keep passwords and sensitive evidence out of the initial form.
Discuss cyber security