IT Security Audit for SMBs: Complete Self-Assessment Guide

Most of the 50-200 employee companies we talk to are in the same situation: they know they should be checking their IT security, but they are not sure where to start or whether they need a professional external audit.

This guide shows you how to assess the state of your IT security internally across 7 critical areas, what specifically to look for, and when it is worth investing in a complete professional audit.

Table of Contents

• What a security audit means for an SMB
• Self-assessment framework: 7 critical areas
• Interpreting results and scoring
• When a professional external audit is worth it
• Next steps after the self-assessment

---

What a Security Audit Means for an SMB

A security audit for a 50-200 employee company focuses on solid fundamentals, not complex enterprise certifications or expensive tools that cannot be justified at this scale. The goal is to identify the critical gaps in the 7 areas where 90% of vulnerabilities show up, then prioritize based on real risk and available resources.

The framework takes 2-3 hours to work through and can be completed entirely in-house or with minimal external support. No advanced technical expertise is required - the checks are clear enough that your existing IT team can run them with minimal guidance.

---

Self-Assessment Framework: 7 Critical Areas

AREA 1: Access Management

The first area checks who has access to what in your company - and, more importantly, who should NOT have access anymore but still does. Former employees with access to critical systems are one of the most underestimated risks in SMBs, with the average incident costing between $30,000-$100,000.

What to check:

• Complete list of active users in critical systems (email, file storage, ERP, accounting, VPN)
• Comparison against the current employee list from HR
• Whether an offboarding process exists and is actually applied
• How often access reviews happen

The check starts with generating the user list from each system and comparing it against the current employee roster. The discrepancies are usually visible immediately - former employees who left months or years ago, unknown users, or test accounts that were never deactivated. The essential part is checking the process itself: is there a documented checklist? Who is responsible? When was the last complete review?

Risk indicators:

• High risk: 3+ former employees with access, no documented process, last review >6 months ago, no one responsible
• Medium risk: 1-2 former employees with access, a process exists but is applied inconsistently, occasional reviews
• Low risk: 0 former employees with access, a documented and enforced process, quarterly reviews with logging

Remediation can be done entirely in-house, at zero cost and 4-6 hours of work. Create an offboarding checklist in Excel, immediately deactivate the access you found, set a quarterly review in the calendar, and automate where possible. If you want external support for a fully customized process plus training on automation, the cost runs $1,000-$3,000.

AREA 2: Backup & Recovery

The second area checks whether your backup actually works when you need it, not just whether it is “configured and running automatically.” We have seen companies discover after an incident that their “automatic” backup had not been saving anything for months or years, because of a configuration error made on day one.

Practical backup test (45 minutes)

Preparation:

• A test system (NOT production)
• 3 files for the test: a financial Excel file, an important document, a recent email

Execution:

• Delete the files from the test system
• Initiate recovery from backup
• Time each restore
• Verify integrity: is the file identical to the original?

Configuration check:

• Is the backup on the same server as the data? (the answer must be NO)
• Is it permanently connected to the network? (ransomware risk)
• Is there an alert if the backup fails?
• Who checks the alerts?

The critical part: many companies have a backup configured that runs daily and sends an email saying “backup completed successfully” - but the email only confirms the script ran, not that it actually saved anything. A live test is the only method of real validation.

Risk indicators:

• Critical risk: no recovery test ever performed, backup on the same server as the data, recovery takes >4 hours or fails
• Medium risk: tests done occasionally (>3 months apart), backup partially isolated, slow recovery (2-4 hours)
• Low risk: documented monthly test, fully isolated backup, recovery <1 hour, multiple copies (the 3-2-1 rule)

Internal remediation costs between $0 and $6,000 and takes 1-2 days. Institute a monthly 30-minute test with tracking in Excel, isolate the backup by manually disconnecting it after each run, and turn on the alerts you already have. If you need an infrastructure upgrade: an isolated NAS costs $4,000-$8,000 one-time, and cloud backup for Google Workspace runs $3-$6 per user per month.

AREA 3: Multi-Factor Authentication (MFA)

Multi-factor authentication is the simplest security measure with the biggest impact - it cuts the risk of password-based compromise by 99%. The check takes 15 minutes and starts with a very simple test: try logging into your email without your phone next to you. If you can get in, MFA is not enabled - and your company is exposed to the category of attacks that start with compromised passwords, roughly 40% of the total.

Complete check:

• Personal test: login without your phone (it must fail)
• Corporate email: MFA enabled? YES/NO
• Online banking: MFA enabled? YES/NO
• Accounting platform: MFA enabled? YES/NO
• VPN access: MFA enabled? YES/NO
• Coverage: what % of employees have MFA? Is it mandatory or optional?

Coverage matters as much as activation itself. Optional MFA that employees can ignore helps nothing - it has to be mandatory for everyone, no exceptions. A phased rollout works best: leadership in week 1, managers in week 2, all employees in week 3.

Risk indicators:

• Critical risk: zero MFA on any critical system, email without MFA, MFA optional rather than mandatory
• Medium risk: MFA on email only but missing on the rest; MFA for leadership, not for everyone
• Low risk: MFA mandatory on all critical systems, 100% coverage, documented policy

Remediation is free and takes one day for Google Workspace or Microsoft 365, which have MFA built in. Setup takes 5 minutes per user, using Google Authenticator or Microsoft Authenticator. The ROI is practically infinite - a single prevented breach justifies the effort hundreds of times over.

AREA 4: Password Management

Weak passwords remain one of the most common vulnerabilities in SMBs. Modern dictionary attacks automatically test millions of combinations in a few hours, and weak passwords fall in minutes. The check takes 20 minutes and starts with a password strength audit, using the built-in tools in Active Directory or Google Workspace.

What to check:

• What % of passwords are weak (<12 characters, no complexity)
• Is there a documented password policy?
• Is the policy technically enforced, or is it just a recommendation?
• Are you using a professional password manager?
• Check “Have I Been Pwned” for passwords compromised in breaches

A password manager completely changes the equation. Instead of employees memorizing 12+ character passwords with maximum complexity, the password manager automatically generates fully random 20+ character passwords and stores them securely. The employee memorizes a single master password.

Risk indicators:

• High risk: >20% weak passwords, no policy, passwords reused everywhere, no password manager
• Medium risk: 10-20% weak passwords, a policy exists but is not enforced, a password manager for some people only
• Low risk: <5% weak passwords, a technically enforced policy, a password manager for everyone, regular breach checks

Remediation costs between $5,000 and $10,000 per year and takes a week. A password policy with a 12-character minimum and complexity requirements gets configured with technical enforcement in Active Directory or Google Workspace. A professional password manager like 1Password Business, Bitwarden Teams, or Keeper costs $4-$8 per user per month, setup takes a day, and training takes 2 hours. The ROI is clear when you compare it to the cost of a breach: $60,000-$200,000 vs roughly $5,000 per year for 50 employees.

AREA 5: Incident Response

Without a documented incident response plan, your company will lose 12-18 hours in total chaos when a server goes down or a security incident hits. With a tested plan, response time drops to 2-4 hours of organized recovery.

What to check:

• Does an “Incident Response Plan” document exist?
• When was it created/updated?
• Does it include: contacts (primary + backup), a process for the common scenarios, decision authority, a communication protocol, a procedure for notifying authorities where required (FBI IC3, state breach-notification laws)
• When was it last tested, and how?
• Were the problems discovered in the test actually fixed?

Testing matters as much as having the plan. A plan that has never been tested is almost as bad as no plan at all - you do not know whether the contacts are current, whether the process holds up under pressure, or whether the team truly understands what to do. An annual tabletop exercise identifies the problems and bottlenecks before you hit them in a real crisis.

Risk indicators:

• High risk: no documented plan, “we will figure it out somehow,” no test ever run, outdated contacts
• Medium risk: a plan exists but is outdated (>1 year), never tested, incomplete - with missing scenarios
• Low risk: a complete documented plan (2-5 pages), tested annually, updated after every test, and the team knows where it is

Internal remediation costs nothing and takes 1-2 days. Templates are available online and can be customized - 2 pages are enough to start, covering contacts, process, and the common scenarios. External support for a fully customized plan, a 2-3 hour team training, and an initial simulation costs $4,000-$8,000. The benefit is cutting response time from 12-18 hours of chaos to 2-4 hours of organized process.

AREA 6: Security Awareness Training

Human error remains the number one cause of security breaches - over 90% of all incidents. Annual training is completely ineffective, because information retention drops dramatically after just 3 months and employees slide back into unsafe behavior.

What to check:

• When was the last security training?
• How often does it happen? (annually, quarterly, never)
• Are simulated phishing tests run?
• If YES: when was the last one, and what were the results?
• Is there tracking of improvement over time?

The testing part is critical, because it is the only way to measure whether the training works. You can run annual training where everyone signs that they understood, but if 35% click the first simulated phishing email, the training did not work at all. Quarterly simulations with immediate feedback change the picture completely.

Risk indicators:

• High risk: zero training in the last 2+ years, “they signed that they understood,” no phishing tests, unknown click rate
• Medium risk: annual training (insufficient), occasional tests, click rate >20%, no tracking
• Low risk: quarterly simulations, click rate <10% and consistently declining, tracking and measurable improvement

Dedicated platforms like KnowBe4 or Cofense cost $2,000-$4,000 per year and provide full automation with advanced reporting. The expected results are clear: click rates drop from 30-40% to 5-10% after 6 months of consistent simulations.

AREA 7: Shadow IT

Shadow IT means SaaS applications connected to corporate accounts that the IT department knows nothing about. The problem is that IT cannot secure what it does not know exists, and corporate data in uncontrolled external apps means direct risk of data leaks and loss of control.

How to check:

• Google Workspace: Admin Console → Security → API Controls (see all connected third-party apps)
• Microsoft 365: Microsoft Entra ID (Azure AD) → Enterprise Applications (complete list of apps with access)

Categories:

• Officially authorized applications
• Unauthorized applications (shadow IT)
• Completely unknown applications
• Applications with high-risk access (email, drive)

The audit usually turns up unpleasant surprises: WeTransfer for unsecured file transfers, personal Dropbox accounts where employees store corporate documents on their own accounts, Trello and Notion holding sensitive data, plus another 15+ random tools connected by employees who just wanted to solve a problem quickly.

Risk indicators:

• High risk: >40 applications, most of them unknown; WeTransfer/personal Dropbox/random tools; no policy
• Medium risk: 20-40 applications, some unauthorized but low-risk, a policy exists but is not applied
• Low risk: <20 applications, all documented, a clear enforced policy, approved corporate alternatives, quarterly review

A quarterly review surfaces problems fast. Immediately revoke access for the unauthorized apps you discover. The rule becomes simple and clear: any new application requires IT approval before it connects to corporate accounts. For every common need, establish officially approved alternatives - Google Drive for file sharing, not personal Dropbox; Slack for communication, not WhatsApp Web. The benefit is direct: IT can only secure what it knows exists, eliminating the blind spots in your infrastructure.

---

Interpreting Results and Scoring

After working through the 7 areas, mark the state of each one: low risk (green), medium risk (yellow), or high risk (red).

Overall interpretation:

• 0-1 red areas: good posture, with low overall risk. Maintain your processes with regular reviews and incremental improvement.
• 2-3 red areas: moderate risk that needs attention within 30-60 days. Prioritize the zero-cost fixes such as MFA and the access review. Internal implementation is feasible with minimal guidance.
• 4-5 red areas: high risk that requires action within 30 days. Consider a professional audit for correct prioritization and allocate budget for the critical fixes.
• 6-7 red areas: critical risk. An urgent professional audit, plus an implementation roadmap with specialized support.

---

When a Professional External Audit Is Worth It

Internal self-assessment is enough when you have 0-2 red areas identified, your IT team understands what needs fixing, you have time available to implement within 30-90 days, the budget is limited (under $10,000), and there is no external deadline such as a formal audit or a requirement from a customer. In those cases, use this guide for internal remediation, possibly with targeted consulting on specific areas.

A professional audit adds value when you have:

• 3+ red areas identified in the self-assessment
• Increased complexity where it is not clear how to prioritize
• An external deadline (a SOC 2 or HIPAA audit, ISO 27001, or a requirement from a large enterprise customer)
• An overwhelmed IT team with no time to implement
• The need for external proof for your board/investors/customers

What a professional audit includes:

Phase 1: Discovery & Assessment (2-3 days). The complete evaluation includes an infrastructure review, verification of all 7 areas plus industry-specific aspects, interviews with management and the IT team, and specific testing where needed for validation.

Phase 2: Analysis & Prioritization (1-2 days). Identifying gaps against best practices, risk scoring for every gap found, prioritization based on the real impact on your business, and cost estimates for remediation.

Phase 3: Reporting (1-2 days).

• Executive Summary (2-4 pages): overall security state (Green/Yellow/Red), the top 5 risks for the business, the total estimated remediation budget, a recommended timeline
• Technical Report (15-30 pages): the vulnerabilities identified in each area, evidence (screenshots, system logs, configurations), specific recommendations for the IT team, an implementation guide
• Implementation roadmap (30-60-90 days): what gets fixed when, who owns each task (internal or external), what has to happen before what, checkpoints at the important milestones

Phase 4: Handover & Support. A question-and-answer session with management (60-90 minutes), a detailed technical walkthrough with the IT team (90-120 minutes), vendor and software recommendations where needed, and follow-up assistance for a limited period.

Investment: a professional audit costs between $8,000 and $18,000 for 50-200 employee companies (it varies with infrastructure size and complexity). The timeline is 10-14 days from kickoff to final report - and faster if there is an urgent situation. The return on investment is clear: preventing a single incident saves $100,000-$400,000, correct prioritization avoids $40,000-$100,000 in wrong investments, and optimized planning saves 30-50% of the time compared to internal trial and error.

---

Next Steps After the Self-Assessment

You identified 0-2 red areas: keep running your existing processes with vigilance, institute a quarterly check using this guide, and document everything as audit evidence. Investment: $0 ongoing for maintenance. You are in the top 20% of companies your size.

You identified 3-4 red areas: in the first 7 days, prioritize the zero-cost fixes - MFA, the access review, the backup test. Allocate budget for the fixes that cost money, such as a password manager or backup infrastructure upgrades. Set a 30-60 day deadline for implementation. Investment: $6,000-$18,000 for remediation.

You identified 5-7 red areas: immediate action - a professional audit for a complete evaluation and correct prioritization, an implementation plan with clear ownership, and budget allocated for the critical fixes. Recommended duration: 60-90 days for full implementation. Investment: $30,000-$60,000 (audit plus implementation). ROI: preventing a $100,000-$1,000,000 incident justifies the investment.

---

Conclusion

An IT security self-assessment for an SMB does not have to be complicated or expensive. This guide enables an internal evaluation in 2-3 hours to identify the critical vulnerabilities. Most companies discover 2-4 areas that need attention - that is normal, and fixable within 30-90 days with internal resources plus a minimal investment.

Step one is to work through this guide with your IT team this week. Step two is to prioritize the fixes by impact and cost. Step three is to implement, document, and repeat quarterly, for continuous vigilance.

Need support?

If your self-assessment identified 3+ red areas and you want concrete recommendations on next steps, we offer a free initial 30-minute conversation for a preliminary evaluation.

Book your free consultation here