Over 13 years of managing IT security for Texas businesses, I've developed this checklist from real incidents, real breaches I've helped clean up, and the patterns I see every week. This isn't theoretical — every item on this list exists because I've seen what happens when it's missing.

Section 1: Endpoint Security (8 Points)

  1. EDR deployed on every endpoint — Not traditional antivirus. Endpoint Detection and Response (EDR) with behavioral AI. We use SentinelOne and Huntress. Verify: every laptop, desktop, and server has an active agent reporting to a central console.
  2. All operating systems fully patched — Windows, macOS, Linux. Patches applied within 72 hours for critical vulnerabilities, 14 days for standard updates. Check: no endpoints running unsupported OS versions (Windows 8.1, Windows Server 2012).
  3. Local admin rights restricted — Standard users should not have local administrator privileges. This prevents malware from installing system-level rootkits.
  4. Full-disk encryption enabled — BitLocker (Windows) or FileVault (Mac) on every device. Recovery keys stored securely by your MSP.
  5. Automatic screen lock configured — 5-minute timeout. Prevents unauthorized access to unattended workstations.
  6. USB device policies enforced — Block unauthorized USB storage devices via endpoint management policy.
  7. Mobile Device Management (MDM) active — Microsoft Intune or equivalent. Remote wipe capability for lost/stolen devices. Enforce device encryption and PIN requirements.
  8. Application whitelisting/control — Restrict what software can be installed. Prevents users from installing compromised or unauthorized applications.

Section 2: Identity & Access Management (7 Points)

  1. MFA enabled on ALL accounts — Microsoft 365, VPN, admin portals, cloud apps, banking. No exceptions. Use authenticator apps (not SMS when possible). MFA blocks 99.9% of automated attacks.
  2. Password policy enforced — Minimum 14 characters. Consider passphrase approach (e.g., "CorrectHorseBatteryStaple"). No forced rotation (NIST guidance) — change on compromise only.
  3. Privileged access separate from daily accounts — Admin tasks require separate admin accounts. Daily work uses standard accounts. This limits blast radius if a daily-use account is compromised.
  4. Offboarding procedures documented — When an employee leaves: disable account within 4 hours, revoke all access tokens, change shared passwords, disable VPN access, remote wipe company data from personal devices.
  5. Conditional Access policies active — Block sign-ins from risky locations, require MFA for new devices, block legacy authentication protocols.
  6. Password manager deployed — 1Password or Bitwarden for all shared credentials. No passwords stored in spreadsheets, sticky notes, or browser-only storage.
  7. Single Sign-On (SSO) where possible — Reduce password fatigue and improve security by centralizing authentication through Microsoft Entra ID or equivalent.

Section 3: Email Security (6 Points)

  1. Advanced email filtering active — Proofpoint, Guardz, or Microsoft Defender for Office 365. Catches BEC, phishing, malicious attachments, and credential harvesting links.
  2. SPF, DKIM, and DMARC configured — DNS records that prevent email spoofing of your domain. DMARC policy should be "reject" — not just "monitor."
  3. External email warning banner enabled — Automatically flags emails from outside your organization. Helps employees recognize impersonation attempts.
  4. Phishing simulation campaigns running — Monthly simulated phishing emails to test employee awareness. Track click rates and provide remedial training for repeat clickers. BVTech clients average <5% click rates after 6 months of training.
  5. Auto-forwarding rules blocked — Prevent attackers from silently forwarding copies of incoming email to external addresses (a common BEC tactic).
  6. Attachment sandboxing enabled — Suspicious attachments detonated in a sandbox before delivery. Catches zero-day malware that signature-based scanning misses.

Section 4: Network Security (7 Points)

  1. Firewall with active threat intelligence — Next-gen firewall (not just a consumer router). Intrusion detection/prevention, geo-blocking, application-aware rules.
  2. Network segmentation implemented — Minimum 3 VLANs: corporate, guest Wi-Fi, IoT/cameras. PCI DSS environments need additional segmentation for cardholder data.
  3. DNS filtering active — Blocks access to known malicious domains, phishing sites, and inappropriate content at the DNS level.
  4. Wi-Fi using WPA3 or WPA2-Enterprise — Guest network with captive portal and bandwidth limits. Corporate Wi-Fi with certificate-based authentication.
  5. Remote access via VPN or Zero Trust — No RDP directly exposed to the internet. VPN with MFA or Zero Trust Network Access (ZTNA) for remote workers.
  6. Network monitoring active — SNMP monitoring on all switches, access points, and firewalls. Alerts for unusual traffic patterns, port scans, or unauthorized devices.
  7. Firmware current on all network devices — Routers, switches, access points, firewalls. Outdated firmware is a common entry point for attackers.

Section 5: Data Backup & Recovery (6 Points)

  1. 3-2-1-1-0 backup strategy implemented — 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors (verified by test restores).
  2. Automated daily backups running — Image-based backups for servers, file-level for workstations, M365 backup for cloud data (Microsoft does NOT back up your data by default).
  3. Weekly test restores performed — Verify that backups are actually recoverable. A backup that hasn't been tested is not a backup.
  4. Immutable backup copy maintained — At least one backup copy that cannot be modified or deleted — even by an administrator. This is your ransomware safety net.
  5. Recovery Time Objectives (RTO) defined — How long can your business survive without IT systems? 4 hours? 24 hours? Your backup solution must meet this target.
  6. Disaster recovery plan documented and tested — Written procedures for full recovery. Tested annually at minimum. Key staff know their roles without reading the document.

Section 6: Compliance & Documentation (4 Points)

  1. Acceptable Use Policy signed by all employees — Defines appropriate use of company technology, data handling requirements, and consequences for violations.
  2. Incident Response Plan documented — Detect → Contain → Eradicate → Recover → Review. Contact lists, communication templates, legal/regulatory notification requirements.
  3. Industry-specific compliance verified — HIPAA risk assessment (healthcare), PCI DSS SAQ (payment processing), TX Identity Theft Act compliance (all businesses with personal data).
  4. Vendor access documented and reviewed — List all third-party vendors with access to your systems. Review access quarterly. Require MFA and audit logging for vendor connections.

Section 7: Employee Training & Culture (4 Points)

  1. Security awareness training completed by all staff — Annual minimum, quarterly recommended. Cover phishing, social engineering, password hygiene, physical security, data handling.
  2. Phishing reporting mechanism in place — One-click "Report Phish" button in email client. Reward reporting, never punish for reporting false positives.
  3. Physical security basics addressed — Clean desk policy, visitor badges, server room locked, screen privacy filters for public-facing workstations.
  4. Security champion identified per department — One person per team responsible for reinforcing security culture and escalating concerns.

How to Use This Checklist

Score each item: 2 = fully implemented and verified, 1 = partially implemented, 0 = not implemented. Maximum score: 84. Here's how to interpret your results:

Score RangeAssessmentPriority
70-84Strong security postureMaintain and optimize
50-69Moderate — significant gaps existAddress gaps within 90 days
30-49Weak — high risk of breachImmediate remediation needed
0-29Critical — unprotectedEmergency intervention required

If your score is below 70, I'd recommend scheduling a free IT assessment with BVTech. We'll walk through each item, identify your specific gaps, and provide a prioritized remediation plan — no obligation, no pressure.

→ Our Cybersecurity Services → Complete Texas SMB IT Guide → Case Studies → Managed IT Services → Free IT Assessment → More IT Insights

Frequently Asked Questions

Multi-factor authentication (MFA) on all business accounts is the single highest-impact measure. Microsoft reports that MFA blocks 99.9% of automated attacks. Combined with EDR, these two measures prevent the vast majority of breaches targeting SMBs.
Monthly phishing simulations plus quarterly formal training sessions. BVTech provides ongoing security awareness training with tracked completion rates. Businesses training monthly see 70% fewer successful phishing attacks than those training annually.
A documented procedure for detecting, containing, eradicating, and recovering from cybersecurity incidents. It defines roles, communication protocols, technical steps, and compliance requirements. BVTech creates customized incident response plans for all managed clients.
Jordan Polasek — Founder of BVTech LLC

Jordan Polasek

Founder & Managing Partner of BVTech LLC since 2013. With 13+ years of hands-on IT experience serving Texas businesses, Jordan specializes in cybersecurity, cloud architecture, and enterprise networking. He holds a AWS-certified in Cloud Computing, is AWS certified, and won the SuperOps MSP Award for Solo MSP of the Year in 2023. Jordan is a Microsoft CSP Reseller Partner and AT&T Business partner who actively mentors college students pursuing IT careers.

AWS Certified Microsoft CSP Partner AT&T Business Partner SuperOps MSP 2023 AWS Certified Cloud Computing 13+ Years Experience

LinkedIn Profile · jordanpolasek.com · Full Bio →