What a practical cybersecurity review should cover

Guidance

Start with the organisation and its priorities

Security controls only make sense in context. A review should begin by understanding what the organisation does, the information it depends on, where interruption would cause the most harm and which obligations influence its decisions.

This prevents a generic checklist from giving low-value issues the same attention as risks that could affect customers, finances or continued operation.

• Critical services and business processes
• Sensitive, commercial or personal information
• Important suppliers and external dependencies
• Legal, contractual and insurance requirements
• Likely operational consequences of disruption

Guidance

Review identity and access

Accounts and permissions are among the most important areas to understand because they connect people to systems and information. The review should examine how access is granted, protected, changed and removed throughout the user lifecycle.

Pay particular attention to administrative privileges and accounts that are shared, unused or no longer associated with a current employee or supplier.

• Multi-factor authentication coverage
• Administrative and privileged accounts
• Joiner, mover and leaver processes
• Shared accounts and password practices
• Conditional access and remote access arrangements

Guidance

Understand devices and everyday protection

Laptops, desktops and mobile devices are where many users interact with company information. A practical review considers whether devices are known, supported, updated and appropriately protected.

Technology controls should also be examined through the user experience. If protection is inconsistent or too difficult to follow, people may create workarounds that reduce its value.

• Device inventory and ownership
• Operating-system and application updates
• Endpoint protection and security monitoring
• Encryption and local administrator rights
• Guidance for remote and personally owned devices

Guidance

Examine cloud services, email and information sharing

Cloud platforms can improve collaboration while also making permissions, external sharing and configuration harder to see. Review how Microsoft 365 and other services are administered, how information leaves the organisation and who can introduce new applications.

Email remains an important route for fraud and account compromise, so protective configuration and user reporting routes should be part of the review.

• Tenant and security configuration
• External sharing and guest access
• Email authentication and anti-phishing controls
• Application consent and third-party integrations
• Data retention and ownership

Guidance

Test the assumptions behind backup and recovery

Security resilience includes the ability to recover. A review should establish what is backed up, whether copies are appropriately protected and how the organisation expects restoration to work.

The existence of a backup job is not the same as a demonstrated recovery capability. Priorities, dependencies and testing should be visible.

• Coverage of critical systems and cloud data
• Retention and separation from production access
• Restore testing and evidence
• Recovery ownership and escalation
• Alignment with operational priorities

Guidance

Turn findings into an owned plan

The final output should distinguish urgent exposure from longer-term improvement. Each action needs an owner, a reason and a sensible sequence. Technical severity alone should not determine priority; operational impact and feasibility matter too.

A review becomes valuable when leaders can understand the decisions and teams can act on them. Clear language and regular follow-up are therefore part of the security control, not simply presentation choices.