Back to Checklists and audits

To keep a copy, print this page or save it as a PDF from your browser.

Salmini Checklist1 page

Policies and Training · Checklists and audits

Checklists and audits checklist

Who leads Whoever looks after digital security Name

Use it when

it's time for the check every three months, or someone has just joined or left.

Every three months

Devices signed in to your key accounts, and logins nobody recognises.
Admin rights, and anyone who has left but still has access.
Two-factor on for everyone, and recovery emails and numbers current.
Updates installed, and devices that no longer get them flagged for replacement.
A backup tested by restoring one file.

Every six months, or at least once a year

Practise your incident response plan with a tabletop exercise.

Every year

Re-run SIIRF’s Readiness Assessment.
Review your policies, your incident response plan and your risk assessment.

When someone joins or leaves, and after any incident

Check their access, on the way in and on the way out.
After an incident, check the parts of the plan it touched.

Notes

Take care: A list of your gaps shows an attacker where to push. Store the results securely.

Started Done Review again