>

Imagoat

$title =

How to Conduct a Cybersecurity Audit for Your Small Business

;

$content = [

A small business cybersecurity audit is a structured review that defines scope, inventories assets, identifies threats and vulnerabilities, checks existing controls against a recognized framework, ranks the risks, and produces a prioritized remediation plan that is tracked and repeated on a regular schedule. You do not need an outside firm for a useful first pass. With free tools and a framework such as the NIST Cybersecurity Framework 2.0 or CIS Controls v8 Implementation Group 1 (IG1), a small business can complete a meaningful audit in a few days to a few weeks. NIST's own small business guide, NIST IR 7621 Rev. 1, follows the same logic: identify what you have, protect it, detect problems, respond, and recover.

This guide follows a worked example: Harbor Street Dental, a fictional 14-person office with 16 laptops and desktops, one Microsoft 365 tenant, a cloud practice-management system, a small office network, and a part-time IT contractor. Swap in your own numbers as you go. Standards and vendor documents referenced throughout are listed at the end.

Define the Audit Scope and Goals

Decide what is in and out of scope before touching any tools. Scope defines which locations, systems, people, and data types you will examine, and the goal defines why. Common goals are meeting a cyber insurance requirement, satisfying a client questionnaire, complying with HIPAA or PCI DSS, or simply learning where you are exposed. Note that the HIPAA Security Rule (45 CFR 164.308(a)(1)(ii)(A)) explicitly requires covered entities to conduct an accurate and thorough risk analysis, so for a dental office this audit also serves a legal purpose.

Harbor Street Dental writes this scope statement and saves it as the first page of the audit folder:

AUDIT SCOPE - Harbor Street Dental
Date range: Nov 3 - Nov 21, 2026
Owner: Dana Ortiz (office manager)   Technical lead: Sam Lee (IT contractor)
In scope: 16 endpoints, 1 office network (router, firewall, 1 Wi-Fi AP),
          Microsoft 365 tenant, practice-management SaaS, backup system,
          3 key vendors (billing, IT contractor, phone/ISP)
Out of scope: Staff personal phones (BYOD policy reviewed only)
Goals: 1) Meet cyber insurance renewal requirements (MFA, backups, EDR)
       2) Identify top 10 risks to patient data
       3) Produce a 90-day remediation plan
Framework: CIS Controls v8 IG1

Choose a Security Framework to Audit Against

A framework gives you a checklist someone else already thought hard about, so you are not inventing criteria. Two practical choices for small businesses:

  • CIS Controls v8 Implementation Group 1 (IG1): 56 safeguards, published by the Center for Internet Security as "essential cyber hygiene" for organizations with limited IT staff. It is specific and action-oriented, which makes it easy to mark each item as met, partially met, or not met.
  • NIST Cybersecurity Framework 2.0 (released February 2024): organized around Govern, Identify, Protect, Detect, Respond, and Recover. It is broader and better for communicating with executives, insurers, and regulators. NIST also publishes small business quick-start guides for it.
  • Regulation-specific requirements: add HIPAA Security Rule (45 CFR Part 164), PCI DSS v4.0, or contract clauses on top if they apply to you. A dental office, for example, layers HIPAA on top of CIS IG1.

Create a simple tracking sheet with one row per safeguard. Columns: control ID, requirement, status (Met / Partial / Not met / N/A), evidence, owner, notes. A CSV works fine:

control,requirement,status,evidence,owner,notes
CIS 1.1,Maintain asset inventory,Partial,inventory.xlsx missing 3 laptops,Sam,Add phones and printers
CIS 5.2,Unique passwords,Partial,4 shared accounts found,Dana,Replace shared front-desk login
CIS 6.3,MFA on external apps,Not met,MFA off for 6 of 14 M365 users,Sam,Enforce via Conditional Access
CIS 11.2,Automated backups,Met,Backup job log 11/02 success,Sam,Test restore pending

Inventory All Hardware, Software, and Data Assets

You cannot protect what you do not know exists. That is why CIS Controls v8 makes inventory of enterprise assets (Control 1) and software assets (Control 2) the first two controls. Build an inventory of every laptop, desktop, server, phone, printer, router, camera, and IoT device, plus every software application and SaaS subscription. Check accounting records and credit card statements for forgotten subscriptions; shadow IT often hides there.

To discover devices on your network, run an Nmap ping scan from a machine on the office LAN. Only scan networks you own or have written permission to test.

# Install on macOS (Homebrew) or use apt install nmap on Debian/Ubuntu
brew install nmap

# Discover live hosts on the office subnet and save the output
nmap -sn 192.168.1.0/24 -oN ~/audit/live-hosts.txt

# Sample output
Nmap scan report for 192.168.1.1        (router)
Nmap scan report for 192.168.1.20       (front-desk PC)
Nmap scan report for 192.168.1.47       (unknown device)
Nmap scan report for 192.168.1.52       (network printer)
Nmap done: 256 IP addresses (19 hosts up) in 3.41 seconds

Harbor Street Dental expected 16 computers plus a printer, router, and access point (19 devices). The scan shows 19 hosts, but 192.168.1.47 is not on the list. It turns out to be a staff member's personal tablet on the main network. That is the first finding: guest and personal devices need a separate network.

For Windows software inventory, PowerShell can export installed applications from each machine:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Select-Object DisplayName, DisplayVersion, Publisher |
  Where-Object { $_.DisplayName } |
  Sort-Object DisplayName |
  Export-Csv C:\audit\software-$env:COMPUTERNAME.csv -NoTypeInformation

Map Where Sensitive Data Is Stored and Who Can Access It

List your sensitive data types (customer records, payment data, health information, payroll, contracts, credentials) and note where each lives: cloud apps, local drives, email attachments, USB sticks, paper files. Then note who can access each location. This maps to CIS Control 3 (Data Protection), which begins with a data inventory.

  • Patient records: practice-management SaaS (all 14 staff), plus exported PDFs on the front-desk PC desktop (finding: unencrypted copies)
  • Payroll: accountant's portal (Dana only)
  • Insurance claims: billing vendor portal (3 staff)
  • Backups: external NAS and cloud backup (Sam only)

Find stray sensitive files quickly by searching for common patterns. This example looks for files containing Social Security number formats in a shared folder on Linux or macOS:

grep -rEl '[0-9]{3}-[0-9]{2}-[0-9]{4}' /Volumes/Shared/ 2>/dev/null | head -20

Review User Accounts, Permissions, and Password Practices

Export the user list from every major system and compare it to your current employee roster. Look for former employees, shared accounts, generic logins like "frontdesk", and people with admin rights who do not need them. CIS Controls 5 (Account Management) and 6 (Access Control Management) call for exactly this kind of recurring review; CIS IG1 safeguard 5.3 specifically requires disabling dormant accounts after 45 days of inactivity.

For Microsoft 365, connect with the Microsoft Graph PowerShell module and list users with their last sign-in:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"

Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled,SignInActivity |
  Select DisplayName, UserPrincipalName, AccountEnabled,
    @{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}} |
  Sort LastSignIn |
  Export-Csv C:\audit\m365-users.csv -NoTypeInformation

Harbor Street Dental finds 17 accounts for 14 employees. Two belong to a hygienist who left eight months ago (one still enabled), and one is a shared "frontdesk@" mailbox with a password last changed in 2022. Also check that passwords follow current NIST guidance in SP 800-63B: no forced periodic rotation, no arbitrary complexity rules, screening against known-breached passwords, and length as the main requirement (the 2025 revision, Rev. 4, sets 15 characters as the minimum when a password is the only factor, and 8 when it is paired with MFA). Give everyone a password manager.

Check Multi-Factor Authentication and Remote Access Settings

MFA blocks the large majority of credential-based attacks. A 2023 Microsoft Research study of Azure AD accounts found MFA reduced the risk of account compromise by 99.22 percent overall, and by 98.56 percent even when the credentials were already leaked. Verify it on email, VPN, remote desktop, accounting software, banking, and admin accounts first. PCI DSS v4.0 (requirement 8.4.2) also requires MFA for all access into the cardholder data environment. Do not rely on what people say; check the settings.

# List users and their registered authentication methods (requires UserAuthenticationMethod.Read.All)
Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","User.Read.All"

Get-MgUser -All | ForEach-Object {
  $methods = Get-MgUserAuthenticationMethod -UserId $_.Id
  [pscustomobject]@{
    User = $_.UserPrincipalName
    MethodCount = ($methods | Measure-Object).Count
  }
} | Where-Object { $_.MethodCount -le 1 }   # only password registered = no MFA

For remote access, check whether Remote Desktop Protocol (port 3389) is exposed to the internet. CISA's StopRansomware guidance lists exposed RDP among the most common initial access routes for ransomware actors. From a machine outside your network, or using your public IP, run:

nmap -Pn -p 3389,22,445,5900 203.0.113.25

PORT     STATE    SERVICE
22/tcp   filtered ssh
445/tcp  filtered microsoft-ds
3389/tcp open     ms-wbt-server   <-- exposed RDP
5900/tcp filtered vnc

An open 3389 is a high-severity finding. The fix is to close the port on the firewall and require a VPN or a zero-trust access tool with MFA instead.

Scan Networks and Devices for Vulnerabilities

Run an authenticated vulnerability scan if you can, since it sees missing patches and weak configurations that an external scan misses. This is the focus of CIS Control 7 (Continuous Vulnerability Management). Free or low-cost options include OpenVAS (Greenbone Community Edition), Nessus Essentials (Tenable's free tier, limited to 16 IP addresses, which fits many small offices), and Microsoft Defender Vulnerability Management if you have Business Premium.

# Service and version detection against the router and key hosts
nmap -sV --top-ports 100 192.168.1.1 192.168.1.20 192.168.1.52 -oN ~/audit/services.txt

# Check a web-facing host for weak TLS
nmap --script ssl-enum-ciphers -p 443 portal.harborstreetdental.example

Group results by severity (Critical, High, Medium, Low, as scored by CVSS) and by asset. In the example, Nessus reports 2 critical, 7 high, and 31 medium findings across 16 hosts. Most traces back to three root causes: an outdated router firmware, an unsupported Windows 10 machine, and an old version of a PDF reader. Fixing root causes clears dozens of findings at once. Also cross-check your software against CISA's Known Exploited Vulnerabilities (KEV) catalog, which lists flaws confirmed to be exploited in the wild and deserves the fastest fixes.

Verify Patching and Software Update Status

Check that operating systems, browsers, firmware, and key applications are current and that automatic updates are on. Also look for end-of-life products, which no longer receive security fixes; Microsoft, for instance, ended Windows 10 support on October 14, 2025 for most editions.

# Windows: last installed updates and OS build
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
(Get-CimInstance Win32_OperatingSystem).Caption, (Get-CimInstance Win32_OperatingSystem).Version
# macOS: pending updates
softwareupdate --list

# Ubuntu/Debian: pending updates
apt list --upgradable

Record each device's patch age. A reasonable small business target, modeled on CISA Binding Operational Directive 19-02 (which gives federal agencies 15 days for critical and 30 days for high-severity findings on internet-facing systems), is critical patches within 14 days (faster for anything on the KEV list) and everything else within 30 days. Harbor Street Dental finds two PCs that have not installed updates in 94 days and one running a Windows version that is out of support; the audit marks all three as high priority.

Evaluate Firewall, Endpoint Protection, and Email Security

Confirm each of these layers is present, enabled, and configured, not just installed.

  • Firewall: default-deny inbound, no unnecessary port forwards, admin interface not reachable from the internet, default admin password changed, firmware current, and separate guest Wi-Fi (CIS safeguards 4.4 and 12.x).
  • Endpoint protection: antivirus or EDR on 100 percent of endpoints, reporting to a console, with tamper protection on. Microsoft Defender for Business or similar satisfies most insurers.
  • Email security: SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489) set up for your domain, plus anti-phishing and attachment filtering.

Check your email authentication records from any terminal:

dig +short TXT harborstreetdental.example | grep spf
"v=spf1 include:spf.protection.outlook.com -all"

dig +short TXT _dmarc.harborstreetdental.example
(no output)   <-- no DMARC record

dig +short TXT selector1._domainkey.harborstreetdental.example
(no output)   <-- DKIM not configured

Here SPF is present but DKIM and DMARC are missing, meaning attackers can more easily spoof the practice's domain. A starting DMARC record in monitoring mode looks like this:

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@harborstreetdental.example; pct=100

After a few weeks of reviewing reports, move the policy to p=quarantine and then p=reject.

To check Windows Defender status on an endpoint:

Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated

Test Backups and Data Recovery Procedures

A backup you have never restored is an assumption, not a control. Verify the 3-2-1 pattern (three copies, two media types, one offsite, a rule popularized by US-CERT/CISA backup guidance), check that at least one copy is offline or immutable so ransomware cannot encrypt it, and perform an actual restore test. CIS Control 11 (Data Recovery) requires testing backup recovery, not just running backups.

Run a restore drill: pick a random file set and one full system, restore to a separate location, and time it. Harbor Street Dental restores a 4 GB patient-imaging folder and a 12 GB shared drive. The file restore takes 22 minutes, but the full server restore fails because the backup agent was never updated after a Windows upgrade. That is a significant finding that would have been discovered only during a real disaster.

# Verify a backup archive integrity with restic as an example
restic -r /mnt/nas/backup check
restic -r /mnt/nas/backup snapshots --last
restic -r /mnt/nas/backup restore latest --target /tmp/restore-test --include /data/patient-images

# Confirm restored file hashes match the source
sha256sum /data/patient-images/*.dcm | head -3
sha256sum /tmp/restore-test/data/patient-images/*.dcm | head -3

Write down your recovery time objective (how long you can be down) and recovery point objective (how much data you can lose). If the restore test shows a 9-hour recovery but the business can tolerate 4, you have a gap.

Review Security Policies and Employee Training

Check whether written policies exist and whether people actually follow them. The minimum set for a small business is an acceptable use policy, password and MFA policy, incident response plan, data retention and disposal policy, remote work/BYOD policy, and an offboarding checklist. CIS Controls 14 (Security Awareness and Skills Training) and 17 (Incident Response Management) cover these areas.

  • Ask three employees what they would do if they clicked a suspicious link. If answers differ or are "nothing", the incident plan is not working.
  • Check training records: who completed security awareness training in the last 12 months? CIS safeguard 14.1 expects training at hire and annually.
  • Run a simulated phishing test (Microsoft Attack Simulator, GoPhish, or a vendor tool) and record the click rate. Vendor benchmarks such as KnowBe4's annual Phishing by Industry report have put untrained baseline failure rates at roughly one-third of employees; treat your own first result as the baseline and aim for a steady decline.
  • Confirm the offboarding checklist disables accounts, collects devices, and revokes vendor portal access on the last day.

Harbor Street Dental has an acceptable use policy from 2019 but no incident response plan, and only 9 of 14 staff completed training. The simulated phishing test sees 5 of 14 employees click (36 percent), in line with those untrained benchmarks.

Assess Vendor and Third-Party Risks

Your risk includes every vendor with access to your systems or data: IT contractors, payroll processors, cloud software, billing companies, and your ISP. CIS Control 15 (Service Provider Management) asks you to inventory providers and classify them. For each, record what they access, how they connect, and what assurance they provide.

vendor,access,data_type,assurance,mfa_required,finding
PracticeSoft (SaaS),Full patient records,PHI,SOC 2 Type II + BAA,Yes,None
BillingPro,Claims portal,PHI + payment,No report on file,No,Request SOC 2; enforce MFA
Sam Lee (IT contractor),Domain admin + remote tool,All,No NDA/BAA,Partial,Sign BAA; separate admin account
Local ISP,Network edge,Traffic,N/A,N/A,Replace default modem credentials

If you handle regulated data, confirm you have signed agreements (a Business Associate Agreement required by 45 CFR 164.308(b) under HIPAA, a data processing agreement under GDPR Article 28). Ask critical vendors for a SOC 2 report (AICPA) or a completed security questionnaire, and ask how they would notify you of a breach and within what timeframe.

Rank Findings by Likelihood and Business Impact

After the checks, you will have a long list. Score each finding on likelihood (1 to 5) and impact (1 to 5), multiply, and sort. This is a simplified version of the qualitative risk matrix described in NIST SP 800-30 (Guide for Conducting Risk Assessments). Keep it simple so non-technical owners can follow the logic.

Score = Likelihood (1-5) x Impact (1-5)
20-25 Critical | 12-19 High | 6-11 Medium | 1-5 Low

Finding                                   L  I  Score  Rating
RDP exposed to internet                   5  5   25    Critical
MFA missing for 6 of 14 M365 users        4  5   20    Critical
Full server restore fails                 3  5   15    High
Windows 10 machine out of support         4  4   16    High
No DMARC/DKIM                             4  3   12    High
Stale ex-employee account enabled         3  4   12    High
No incident response plan                 3  4   12    High
Personal tablet on main network           3  2    6    Medium

Adjust scores for context. A medium technical issue on the system that holds all patient data may deserve a higher impact score than the same issue on a spare printer.

Build and Assign a Prioritized Remediation Plan

Turn findings into tasks with an owner, a due date, a cost estimate, and a definition of done. Start with quick wins that remove the most risk for the least effort, then schedule larger projects.

WEEK 1 (Critical)
- Close port 3389 on firewall; require VPN for remote access   Owner: Sam   Cost: $0     Done: external scan shows 3389 filtered
- Enforce MFA for all M365 users via Conditional Access        Owner: Sam   Cost: $0     Done: 14/14 users registered
- Disable ex-employee account; delete shared frontdesk login   Owner: Dana  Cost: $0     Done: user export shows 14 active

DAYS 8-30 (High)
- Fix backup agent, rerun full restore test                    Owner: Sam   Cost: $0     Done: restore completes in under 4 hrs
- Replace unsupported Windows 10 PC                            Owner: Dana  Cost: ~$850   Done: old PC wiped and retired
- Publish DKIM; add DMARC p=none then p=quarantine             Owner: Sam   Cost: $0     Done: dig returns records
- Write 2-page incident response plan                          Owner: Dana  Cost: $0     Done: plan signed, printed, tested

DAYS 31-90 (Medium)
- Create guest/IoT VLAN or separate SSID                       Owner: Sam   Cost: $0-$150
- Quarterly phishing simulation + annual training              Owner: Dana  Cost: ~$300/yr
- Request SOC 2 from BillingPro; sign BAA with Sam             Owner: Dana  Cost: $0

Each task should have a single named owner. Review progress in a 15-minute check-in every two weeks and track status in the same spreadsheet used for the audit.

Document Results and Schedule the Next Audit

Write a short report that leadership will actually read. Include the scope, date, framework, a one-paragraph summary, the top 5 risks, the remediation plan, and the evidence folder location. Save screenshots, scan exports, and command output as evidence, and store the folder somewhere access-controlled. HIPAA's documentation requirement (45 CFR 164.316(b)) also expects security assessments and actions to be retained for six years.

  • Executive summary: for example, "Of 56 CIS IG1 safeguards, 21 are met, 18 partially met, and 17 not met. Two critical risks were found and will be fixed within 7 days."
  • Scorecard: percent of safeguards met, which you can compare next time
  • Risk register: all findings with scores, owners, and due dates
  • Exceptions: risks the owner formally accepts, with a review date
  • Next audit date and triggers for an earlier review

Repeat a full audit at least once a year, and run lighter quarterly checks on high-change areas: user accounts, patch status, MFA coverage, and backup restores. Trigger an extra review after a security incident, a major system change, moving offices, adopting a new cloud platform, or onboarding a vendor with access to sensitive data. Harbor Street Dental books the next full audit for November 2027 and puts quarterly 90-minute checks on the calendar. Over time, the percentage of safeguards met becomes a clear measure of whether the business is getting safer.

Sources and Further Reading

  • NIST IR 7621 Rev. 1, Small Business Information Security: The Fundamentals
  • NIST Cybersecurity Framework 2.0 (2024) and NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
  • NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (Rev. 4, 2025)
  • CIS Critical Security Controls v8 and Implementation Group 1 guide, Center for Internet Security
  • HIPAA Security Rule, 45 CFR Part 164 (sections 164.308, 164.316), U.S. Department of Health and Human Services
  • PCI DSS v4.0, PCI Security Standards Council (requirement 8.4.2)
  • Microsoft Research, "How effective is multifactor authentication at deterring cyberattacks?" (2023)
  • CISA Binding Operational Directive 19-02, Known Exploited Vulnerabilities catalog, and #StopRansomware Guide
  • IETF RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC)
  • Tenable Nessus Essentials, Greenbone Community Edition, Nmap, and restic official documentation

];

$date =

;

$category =

;

$author =

jokajinx

;

$previous =

;

$next =

;