Use these practical questions to find weak spots in your company’s technology, data, and processes. They can help you build your own IT risk and vulnerability checklist and strengthen your cybersecurity and operational resilience.
Technology and Systems
- Do you use any technologies or systems with known security vulnerabilities (per vendor advisories or CVEs)?
- Are you still running outdated or unsupported software or hardware (end-of-life/EOL)?
- Are your systems, applications, and devices properly configured and secured (hardening, least functionality)?
- Is your software regularly updated and patched to the latest supported versions?
- Have you chosen the right technology for your business needs and security requirements (compliance, scalability, cost)?
Employee Access and Permissions
- Is access to systems coordinated between HR and IT when new employees are onboarded?
- Are user accounts and access rights promptly removed or disabled when employees are offboarded?
- Can former employees or contractors still access your data, apps, or network after offboarding?
- Do employees have more access than they need, or see data they shouldn’t (least privilege)?
- Do your people follow basic cybersecurity practices, like using strong passwords, MFA, and locking devices?
Backup and Recovery
- Do you have regular, verified backups of critical data (including offsite or cloud copies)?
- Do you have a tested disaster recovery and business continuity plan?
- Can your business continue operating if key systems go down (RTO/RPO defined)?
Physical and Network Security
- Is your server room or IT equipment protected against unauthorized physical access?
- Is your office Wi‑Fi properly secured for employees and guests (separate SSIDs, strong encryption)?
- Can former employees or contractors still access your network remotely (VPN, remote tools)?
IT Management and Maintenance
- Do you have qualified IT staff or a managed service provider (MSP) to manage your systems securely?
- Are maintenance and updates for IT assets handled through a defined, documented process?
- Do your employees know and follow your IT and security policies and procedures?
- Does your company have an established, up‑to‑date information security policy?