Most security incidents in small and mid-sized offices don't begin with a sophisticated attack. They begin with something ordinary: a password reused from a personal account, a laptop that missed three months of updates, a firewall nobody has logged into since the day it was installed. Attackers know this, which is why they go after the basics first.

The good news is that the basics are also where most of your protection comes from. This checklist covers the ten controls we would look at first in any office, whether it has 20 people or 500. Answer each one with a simple yes or no. Be honest with yourself: a "sort of" counts as a no.

1. Your firewall is supported, updated and properly configured

A firewall is only as good as its last update. Check three things: that the model is still within the manufacturer's support period, that its software has been updated in the last few months, and that someone has reviewed its rules recently. Plenty of offices still run a firewall with the settings it shipped with, which leaves much of its protection unused.

2. Staff, guests and servers are on separate networks

If a visitor on your guest Wi-Fi can see your file server, you have a problem. Splitting the network into zones, one for staff devices, one for guests and one for servers and critical systems, means that when one device is compromised, the damage stays contained. It is one of the most effective changes an office can make, and often one of the cheapest.

3. Multi-factor authentication is on for email and admin accounts

Stolen and guessed passwords are one of the most common ways attackers get in. Multi-factor authentication (MFA) adds a second step, usually a code or an app prompt on the user's phone, so a password on its own is no longer enough. Start with email (Microsoft 365 or Google Workspace), remote access and every admin account. Those are the keys to everything else.

4. Every device has endpoint protection

Laptops, desktops and servers all need modern endpoint protection, not just the free antivirus that came with the machine. Good endpoint tools watch for suspicious behaviour, such as a program suddenly encrypting hundreds of files, and can isolate the device before the problem spreads. Check that it is installed on every device, including the ones people take home.

5. Updates are installed on a schedule, not "when someone remembers"

Most attacks use weaknesses that already have a fix available. The gap between a patch being released and being installed is the window attackers use. Set a routine: operating systems and browsers update automatically, and servers, firewalls and switches are reviewed every month.

6. Backups exist, are kept separately and have been tested

A backup you have never restored is a hope, not a plan. Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy kept offline or off-site, out of reach of ransomware. Then test it. Pick a folder, restore it, and note how long it takes.

7. Email is filtered and your domain is protected

Phishing emails remain one of the most common ways into a business. A good email filter stops most of them before they reach an inbox. Your own domain needs protection too: SPF, DKIM and DMARC records make it much harder for criminals to send emails that look like they came from your company to your clients and vendors.

8. People only have the access they need, and leavers lose it the same day

Over time, staff collect access to folders, systems and shared accounts they no longer use. Review who can reach what at least twice a year, and make removing access part of every exit process. An old account that still works is an open door.

9. Someone is watching the logs

Firewalls, servers and cloud services all record what happens on them. Those records only help if someone reviews them, or if a monitoring tool raises an alert when something unusual happens, like a login from another country at 3 am. Without monitoring, many offices only learn about a breach once the damage is done.

10. Staff know what to look for, and what to do

Technology covers a lot, but one convincing email can still slip through. Short, regular awareness sessions help people spot phishing messages and fake invoices. Just as important is a simple incident plan: who to call, what to switch off, and how to keep working while the problem is fixed. Write it down before you need it.

What your score means

8 to 10 yes: You have a solid base. Review it every six months, because settings drift as the office changes.

5 to 7 yes: You are covered in places, with gaps an attacker could use. Fix the "no" answers in this order: MFA, backups and updates first, then the rest.

Under 5 yes: Treat this as urgent. A short, structured security assessment will show you where the biggest risks are and what to fix first.

Questions we hear often

We're a small company. Are we really a target?

Yes. Most attacks are automated and look for weak systems, not famous names. Smaller offices are often easier to get into, which is exactly what makes them attractive.

Do we need expensive tools to cover this checklist?

Not always. Several items, such as MFA, network separation and update routines, depend on configuration and habits as much as on products. Where tools are needed, the right choice depends on your size and setup.

How often should we review our security?

At least once a year, and whenever something changes: a new office, a new system, a move to the cloud, or a security incident at a company you work with.

How AYSIT can help

AYSIT Solutions designs, installs and supports security solutions for businesses across Hyderabad, Chennai and Bengaluru, including firewalls, endpoint protection, email security and network security. If your score left you with more questions than answers, our team can audit your current setup and give you a clear list of what to fix first.

Read more about our cyber security solutions, or contact us to talk about your office.