Checklists and audits

Every three months, Grace books 30 minutes at the end of a team meeting in Kampala for a security check. Last time it turned up a former intern who could still open the shared drive, and two colleagues without two-factor on their email. Fixing both took less time than the meeting.

Why check

Good habits slip. A new colleague skips a step, a tool changes its settings, someone leaves and keeps their access. A regular check finds these gaps before an attacker does, by comparing what your policies say with what’s actually happening (SAFETAG). It also shows your progress over time (Protect.ngo).

Two kinds of check

• A self-check you run yourself: a short list, repeated on a schedule, that anyone can follow. SIIRF’s Readiness Assessment is a good one to start with: 32 questions across eight areas, answered yes, partly, no or don’t know.
• An audit by a trained auditor: a deeper look, with technical checks, a report and follow-up, using a method such as SAFETAG. If you can get one, it’s well worth it. If you can’t, meet as a team and work through the key questions yourselves (NDI).

What to check, and when

Every three months

• devices signed in to your key accounts, and any logins you don’t recognise (Access Now)
• who has admin rights, and whether anyone who has left still has access
• two-factor switched on for everyone, and recovery emails and phone numbers up to date
• updates installed, and any device that no longer gets security updates flagged for replacement
• a backup tested by restoring a file from it (SIIRF)

Every six months, or at least once a year

• practise your incident response plan with a tabletop exercise such as SIIRF’s Chips Down

Every year

• re-run SIIRF’s Readiness Assessment
• review your security policies and your incident response plan
• update your risk assessment

When someone joins or leaves, and after any incident

• check their access, on the way in and on the way out (Who has access)
• after an incident, check the parts of your plan and your checks that it touched

Checking a device

These are basics that SAFETAG’s auditors check on computers (SAFETAG). You can look at most of them yourself, in a device’s settings:

• The operating system, browser and other software are up to date. Some systems no longer get security updates, Windows 10 among them since October 2025; plan to replace or upgrade those.
• The built-in antivirus is switched on. On Windows and macOS it’s usually enough.
• Storage is encrypted, and so are external drives.
• Everyday work happens in an account without admin rights.
• Pirated software is replaced with licensed or free open-source software, since it often misses security updates.

Phones and laptops explains each of these settings.

Tools that help

• Each platform’s security page shows the devices signed in and recent activity. Look at it regularly for every important account (Access Now).
• Have I Been Pwned tells you whether an email address appears in a known data breach. You can also search a domain you own, though larger domains need a subscription (Have I Been Pwned).
• SIIRF’s Incident Log keeps a record of what’s happened, so patterns show over time.
• A log of worrying signs (odd messages, a device acting strangely, someone watching the office), looked over weekly or monthly to spot trends (Holistic Security).

Running it as a team

If your team uses personal accounts with no central admin console, make the check a short session: each person opens their own accounts’ security pages and looks at the devices signed in, two-factor and recovery details, with you on hand to help. It’s quick, and people learn where those settings live.

Keep the results safe

A list of your gaps shows an attacker exactly where to push. Store check results and audit reports securely, and treat your log of worrying signs as sensitive too (SAFETAG; Holistic Security).

Where to go next

• Security policies: what you’re checking against.
• Your incident response plan: the plan your checks keep up to date.
• Training your team: turn what the checks find into the next session.
• Phones and laptops: fixing what a device check turns up.