Free Resource

The SME Cyber Risk Checklist

Fifteen areas every business leader should be able to answer. Each one comes with a plain-English explanation of why it matters and three honest response options to work through with your leadership team.

Get the free checklist

Enter your name and email and your checklist will be ready to download instantly. Carl may follow up with a short note — no sales pressure, no mailing list.

We will not share your details with anyone. Read our privacy policy.

About this checklist

Most business leaders know they should have a position on cyber and IT risk. Fewer have actually tested whether they do. This checklist is designed to close that gap — not by adding complexity, but by asking fifteen straightforward questions that every SME board should be able to answer with confidence.

It is not a technical audit. It does not require your IT supplier to be in the room. It is a tool for the leadership team to work through honestly, so you know where you stand before something goes wrong.

1We know who has access to what
2Multi-factor authentication is in place for email and key systems
3Privileged accounts are managed and monitored
4We know where our business-critical data is held
5Our backups are tested and would actually work in a recovery scenario
6Backups are stored separately from the systems they protect
7We know what we would do in the first 24 hours of a cyber incident
8We know our legal and regulatory notification obligations
9Our cyber insurance cover is current and reflects our actual risk
10We have reviewed our MSP contract in the last 12 months
11We receive meaningful reporting from our IT supplier
12We have assessed the risk of our key IT suppliers failing or being compromised
13We know what AI tools our staff are using
14We have considered the data protection implications of our AI usage
15IT and cyber risk is reported to the board or leadership team at least annually

If you work through the checklist and find there are areas where you cannot give a confident answer, the most useful next step is usually an independent view of where you actually stand.

Northstar's Board-Level IT & Cyber Risk Review covers all fifteen areas in depth. It is a one-off, independent assessment delivered as a plain-English report for the leadership team — with a clear, prioritised view of what to address and in what order.

Find out more about the Review

Want to work through this with someone independent?

The checklist tells you where the gaps are. Northstar's Board-Level IT & Cyber Risk Review tells you what they mean and what to do about them — in plain English, without vendor bias.

Talk to Northstar Board-Level Risk Review