Cybersecurity Basics Checklist

Cybersecurity Basics Checklist

Cybersecurity is essential for protecting computers, business systems, online accounts, and sensitive information from unauthorized access, malware, phishing, and other digital threats. Even basic security gaps can expose individuals and organizations to data loss, financial damage, and operational disruption.

This Cybersecurity Basics Checklist helps beginners, students, professionals, small business owners, and IT teams establish essential security practices.

Use this checklist to review your devices, accounts, networks, data protection measures, and incident-response readiness.

1. Identify Your Digital Assets and Risks

• List the computers, smartphones, tablets, and other connected devices you use.

• Identify important business applications and online accounts.

• List the sensitive information you store or process.

• Identify systems that are essential for daily operations.

• Review who has access to important systems and files.

• Identify third-party services that handle your information.

• Consider threats such as phishing, malware, account theft, and data loss.

• Identify the potential impact of losing access to critical systems.

• Prioritize assets based on importance and risk.

• Document the main security concerns.

Verification: Confirm that you understand what needs protection, who can access it, and which security risks require the most attention.

2. Secure Your Devices

• Install operating system security updates.

• Enable automatic updates where appropriate.

• Use a screen lock or device password.

• Enable device encryption where supported.

• Activate built-in security protections.

• Install reputable security software where appropriate.

• Remove applications you no longer need.

• Review application permissions.

• Disable unused services and interfaces where practical.

• Configure automatic screen locking.

• Enable remote locking or wiping where supported and appropriate.

• Review the physical security of devices.

Verification: Confirm that devices are updated, protected against unauthorized access, and configured with appropriate security controls.

3. Strengthen Password Security

• Use a unique password for each important account.

• Create long, difficult-to-guess passwords or passphrases.

• Use a reputable password manager where appropriate.

• Replace default passwords on devices and services.

• Avoid sharing passwords through insecure channels.

• Never store passwords in publicly accessible documents.

• Change passwords promptly if compromise is suspected.

• Review accounts that still use weak or reused passwords.

• Protect the password manager with strong authentication.

• Store recovery information securely.

Verification: Confirm that important accounts do not rely on reused or easily guessed passwords.

4. Enable Multi-Factor Authentication

• Identify accounts that support multi-factor authentication (MFA).

• Enable MFA for email accounts.

• Enable MFA for financial and business accounts where available.

• Enable MFA for administrator accounts.

• Prefer phishing-resistant authentication methods where supported.

• Use an authenticator application or security key when appropriate.

• Secure backup codes.

• Review trusted devices and active sessions.

• Remove access from devices you no longer use.

• Test account recovery procedures safely.

Verification: Confirm that critical accounts require an additional authentication factor and that recovery options are protected.

5. Protect Email and Messaging Accounts

• Check the sender's address before responding to unexpected messages.

• Verify suspicious requests through a separate trusted channel.

• Avoid opening unexpected attachments.

• Inspect links before opening them.

• Be cautious of urgent requests involving money or credentials.

• Never share one-time passwords or authentication codes with others.

• Enable MFA on email accounts.

• Review email forwarding rules.

• Check account recovery details.

• Report suspicious messages through the appropriate process.

• Review connected applications with access to your mailbox.

Verification: Confirm that email accounts are protected and that users know how to recognize and report suspicious messages.

6. Recognize Phishing and Social Engineering

• Check for unusual sender addresses or domains.

• Look for unexpected requests for confidential information.

• Treat urgent payment requests with caution.

• Verify unexpected password-reset messages.

• Be alert to impersonation of managers, vendors, banks, or support teams.

• Avoid downloading files from untrusted sources.

• Do not trust a message solely because it uses a familiar logo.

• Confirm sensitive requests through a known contact method.

• Report suspected phishing to the appropriate team or service.

• Know what to do if you accidentally click a suspicious link.

Verification: Ensure that users can identify suspicious communications and understand how to report potential incidents.

7. Secure Your Internet Connection and Network

• Change default router administrator credentials.

• Use modern Wi-Fi security settings supported by your equipment.

• Set a strong Wi-Fi password.

• Update router firmware where supported.

• Disable unnecessary remote administration.

• Review connected devices periodically.

• Use a guest network for visitors or untrusted devices where appropriate.

• Avoid conducting sensitive work over untrusted public networks without suitable protection.

• Verify the network name before connecting in public places.

• Disable automatic connections to unknown Wi-Fi networks.

• Review network equipment and configuration periodically.

Verification: Confirm that network access is controlled and that routers and other network devices receive appropriate maintenance.

8. Protect Files and Sensitive Data

• Identify files containing confidential or personal information.

• Limit access to people who need the information.

• Use encryption for sensitive data where appropriate.

• Store business files in approved locations.

• Avoid sharing sensitive files through public links.

• Review sharing permissions regularly.

• Remove access when it is no longer needed.

• Dispose of sensitive information securely.

• Avoid storing unnecessary personal information.

• Check how third-party applications handle uploaded data.

• Follow organizational data-handling policies.

Verification: Confirm that sensitive information is stored, shared, retained, and deleted using appropriate controls.

9. Maintain Backups and Recovery Options

• Identify files and systems that need backups.

• Determine how frequently backups should run.

• Automate backups where practical.

• Keep backup copies separate from primary systems.

• Protect backups from unauthorized access.

• Use offline or otherwise isolated backup copies where appropriate.

• Check that backup jobs complete successfully.

• Review backup retention periods.

• Test restoration of representative files or systems.

• Document recovery procedures.

• Assign responsibility for investigating backup failures.

Verification: Confirm that important data can be recovered and that backups are protected against accidental deletion and malicious activity.

10. Keep Software and Applications Updated

• Update operating systems.

• Update browsers and email clients.

• Update productivity applications.

• Update security software.

• Update website platforms, plugins, and dependencies where applicable.

• Review security advisories for critical software.

• Remove unsupported applications.

• Uninstall software that is no longer required.

• Test important applications after major updates.

• Document systems that cannot be updated and the compensating controls in place.

Verification: Confirm that supported software receives security updates and that known vulnerabilities are addressed according to risk.

11. Review User Accounts and Access Permissions

• Maintain an inventory of important user accounts.

• Remove accounts that are no longer needed.

• Disable access for departed employees promptly.

• Review administrator privileges.

• Apply least-privilege access.

• Use separate administrator accounts where appropriate.

• Review access to shared drives and cloud storage.

• Remove unnecessary third-party application permissions.

• Check for unfamiliar active sessions.

• Review service accounts and their permissions.

• Schedule periodic access reviews.

Verification: Ensure that every account has an appropriate owner and only the permissions required for its purpose.

12. Secure Cloud Services and Online Applications

• Enable MFA for cloud administration accounts.

• Review cloud sharing and access settings.

• Avoid publicly exposing confidential storage locations.

• Restrict API permissions to required operations.

• Store API keys and tokens securely.

• Rotate credentials according to organizational policy and risk.

• Review activity logs where available.

• Configure alerts for important security events.

• Check backup and recovery options.

• Review third-party integrations.

• Confirm that cloud data is handled according to applicable policies.

Verification: Confirm that cloud resources are not unintentionally public and that administrative access and integrations are appropriately restricted.

13. Establish Safe Browsing Practices

• Use a supported and updated browser.

• Check website addresses before entering credentials.

• Be cautious of unexpected downloads.

• Avoid installing unverified browser extensions.

• Review extension permissions.

• Remove extensions that are no longer needed.

• Do not ignore browser security warnings.

• Avoid entering sensitive information on suspicious websites.

• Review saved payment information and autofill settings on shared devices.

• Sign out of sensitive accounts on devices you do not control.

Verification: Confirm that browsing habits and browser configurations reduce exposure to suspicious websites and untrusted downloads.

14. Review Logging, Alerts, and Monitoring

• Enable available security alerts for important accounts.

• Review notifications about unfamiliar sign-ins.

• Monitor repeated failed login attempts where possible.

• Review important application and system logs.

• Check alerts from endpoint protection tools.

• Investigate unexpected account changes.

• Confirm that critical alerts reach a responsible person.

• Document recurring suspicious activity.

• Define escalation procedures for serious alerts.

• Avoid collecting or retaining unnecessary sensitive log data.

Verification: Ensure that relevant security events can be detected, reviewed, and escalated appropriately.

15. Prepare an Incident-Response Plan

• Identify who should receive security incident reports.

• Document how to report a suspected compromise.

• Establish a process for assessing the incident.

• Define how compromised accounts or devices can be isolated.

• Identify who can authorize emergency actions.

• Document recovery and restoration procedures.

• Preserve relevant evidence when appropriate.

• Define communication responsibilities.

• Review applicable reporting and notification obligations.

• Conduct a basic incident-response exercise.

• Update procedures after incidents or exercises.

Verification: Confirm that responsible people know how to respond when an account, device, or system may have been compromised.

16. Conduct a Regular Security Review

• Review the security controls covered in this checklist.

• Identify new devices, applications, and accounts.

• Review unresolved security findings.

• Confirm that backups and recovery procedures remain effective.

• Check whether access permissions have changed.

• Review recent security incidents and lessons learned.

• Identify outdated software and unsupported systems.

• Prioritize risks based on likelihood and impact.

• Assign owners and deadlines to corrective actions.

• Record completed improvements.

• Schedule the next review.

Verification: Ensure that security is treated as an ongoing process, with clear ownership and measurable follow-up actions.

Common Cybersecurity Mistakes to Avoid

• Reusing passwords: Use unique passwords and a password manager.

• Ignoring software updates: Apply relevant security fixes promptly.

• Trusting unexpected messages: Verify suspicious requests independently.

• Leaving unnecessary accounts active: Review access and remove permissions that are no longer required.

• Keeping backups connected without protection: Separate and protect recovery copies where practical.

• Sharing confidential files publicly: Check permissions before sending links.

• Ignoring security alerts: Investigate unusual sign-ins and account changes.

• Giving everyone administrator access: Apply least-privilege permissions.

• Assuming security software prevents every threat: Combine technical controls with careful user behaviour.

• Having no recovery plan: Establish clear incident-response and restoration procedures.

Final Cybersecurity Sign-Off

• Important devices and digital assets are identified.

• Devices and applications are updated.

• Passwords and MFA are configured appropriately.

• Email and phishing protections are reviewed.

• Network and cloud settings are checked.

• Sensitive information has appropriate access controls.

• Backups and recovery procedures are verified.

• User accounts and permissions are reviewed.

• Security alerts and logging are configured where available.

• Incident-response procedures are documented.

• Outstanding risks have assigned owners.

• The next security review is scheduled.

Security review owner: ____________________

Review date: ____________________

Outstanding risks: ____________________

Conclusion

Cybersecurity starts with consistent everyday practices. By securing devices, protecting accounts, maintaining backups, controlling access, and preparing for incidents, individuals and organizations can reduce common digital risks and improve their ability to recover when problems occur.

Learn. Prepare. Grow. — GoBizly

Explore more practical technology and AI checklists at GoBizly to strengthen your everyday cybersecurity practices.