Why SMEs need to audit their security
Many SME owners still believe that cyberattacks only target large companies. The opposite is true: SMEs are prime targets, precisely because they are often less well protected than large groups while holding valuable data and access. A ransomware attack can paralyse a business for days and threaten its very survival.
It is not a matter of bad luck but of calculation. Automating attacks against thousands of poorly protected small organisations pays more, for far less effort, than targeting a well-defended large company. Small size, long seen as protection (we are too small to interest anyone), has become an exposure factor, because it often goes hand in hand with a lack of dedicated security resources.
The good news is that a structured security audit can sharply reduce risk without an excessive budget. The point is not to pile up tools but to cover the fundamentals methodically. Here are the ten points we check systematically during an SME audit.
1. Password policy
A minimum length of 12 characters enforced.
Multi-factor authentication (MFA) enabled on all critical accounts.
No password reuse between services.
A password manager deployed (Bitwarden, KeePass).
2. Updates and patches
Operating systems and software up to date (Windows, Linux, macOS).
Security patches applied within 72 hours for critical vulnerabilities.
A documented, automated patch management process.
3. Backups (3-2-1 rule)
Three copies of the data, on two different media, one of them off site.
Backups tested regularly (actual restoration verified).
At least one immutable or offline copy (protection against ransomware).
4. Access rights and accounts
Principle of least privilege applied.
Administrator accounts separate from everyday user accounts.
Quarterly review of access rights.
Accounts of former employees disabled immediately.
5. Perimeter protection
Firewall correctly configured with restrictive rules.
Network segmentation (VLANs) between sensitive zones.
Secure Wi-Fi access (WPA3, separate guest network).
6. Workstation protection
Antivirus or EDR deployed and up to date on every workstation.
Disk encryption enabled (BitLocker, FileVault).
Automatic lock after inactivity.
7. Email and phishing
Anti-spam and anti-phishing filtering enabled.
SPF, DKIM and DMARC configured on the domain.
Regular phishing awareness for staff.
8. Monitoring and logging
Centralised logs (firewall, servers, Active Directory).
Alerts configured on critical events (failed logins, privilege escalation).
Log retention in line with legal obligations.
9. Incident response plan
A documented procedure: who does what in the event of an incident.
Emergency contacts identified (IT provider, national cybersecurity authority or CSIRT, cyber insurer).
A simulation exercise carried out at least once a year.
10. Regulatory compliance
GDPR: record of processing activities, data protection officer appointed where required.
NIS2: eligibility assessed and preparation started early.
Supplier contracts: security and reversibility clauses checked.
Your score
8 to 10 points covered: a good posture, to be maintained with regular audits.
5 to 7 points: gaps to close quickly, especially on backups and MFA.
Fewer than 5 points: high risk, a full audit is recommended without delay.
Three priorities to start with
If this list seems daunting, remember the essentials: three measures offer the best ratio of effort to protection. Multi-factor authentication, which blocks the vast majority of account takeovers. Backups that are tested and kept offline, your only real safety net against ransomware. And staff awareness, because most attacks start with a booby-trapped email, a subject we cover in depth through our cybersecurity awareness training. The human factor remains the first line of defence.
Security is never achieved once and for all: it is maintained through regular reviews, in step with changes in your business and in the threat.
Point 4 (access rights) and point 8 (logging) rely largely on your Active Directory, often the most critical and least monitored component. We carry out Active Directory audits: identifying configuration risks, prioritising fixes and supporting remediation.
Why these ten points in particular
This list is not arbitrary: it matches the checkpoints that recur in recognised cybersecurity frameworks (ISO/IEC 27001, NIST, national guidance such as that of ANSSI in France), simplified so that they remain actionable without prior expertise. Each point covers a distinct family of risk: points 1 and 7 deal with identity (passwords, phishing), points 2 and 6 with the technical attack surface (patches, workstations), points 3 and 9 with resilience (backups, incident response), and points 4, 5 and 8 with access control and visibility (rights, network, logging). Point 10 alone ties everything to regulatory compliance.
This structure also explains why fixing a single point in isolation rarely brings enough benefit: perfectly deployed MFA (point 1) does not help against a backup that has never been tested (point 3) if an attack succeeds anyway.
How to use this checklist
A business owner without technical skills can use this list as an initial self-assessment, without any tool or particular expertise: tick the points already in place, identify the grey areas (often MFA, tested backups and the review of access rights), then discuss them with the IT provider or request a structured audit on the most uncertain points. It is not a substitute for a professional audit, but a way to prioritise the conversation before committing to a scope of work.
Ticking a box is not enough
The main trap of this kind of list is confusing having something with being protected. Ticking backups: yes means nothing if nobody has ever tested a restore; answering MFA: enabled does not help if it covers only half of the sensitive accounts. The value of a point lies not in its presence but in its real effectiveness, and that is precisely the gap a technical audit reveals where self-assessment stops at the surface.
In practice, two points almost always stand out as the most neglected: the regular review of access rights and the immediate deactivation of former employees' accounts. These are simple measures at no cost, but rarely automated for lack of a formal process, so access sometimes lies dormant for months after someone leaves. The time needed to catch up then depends on the starting point: quick fixes, such as enabling MFA or cleaning up obsolete accounts, take a few days, whereas a genuinely tested incident response plan requires a project of several weeks.
A diagnosis, not an end in itself
This checklist is only worth something if it leads to decisions. Once the grey areas have been spotted, it is better to prioritise according to the ratio between effort and protection gained than to fix everything at once, and to cost the remediation once the diagnosis has been made rather than blindly. It is a starting point to gauge your level and frame the conversation with a provider, not a substitute for an audit, which will check the real technical configuration that nobody can tick from memory.
See also our article on the NIS2 directive and our GDPR compliance support. Contact us to plan your audit.