Security Health Check
- Is MFA enabled for all cloud accounts, especially Microsoft 365?
- When was your last security awareness training for staff?
- Are all systems and applications regularly patched and updated?
- Do you have endpoint protection (antivirus/EDR) on all devices?
- Are administrative accounts separate from daily-use accounts?
Backup and Recovery
- Are all critical data and systems backed up?
- When did you last test a backup restoration?
- Do you have off-site or cloud backup for disaster recovery?
- Is your Microsoft 365 data backed up (separate from Microsoft's retention)?
- Do you have a documented disaster recovery plan?
Infrastructure and Operations
- Is your hardware less than 5 years old and still supported?
- Are operating systems current and receiving security updates?
- Do you have monitoring and alerting for critical systems?
- Is your internet connection reliable with adequate bandwidth?
- Do you have documented IT policies that staff acknowledge?
Scoring Your Health Check
- 12-15 "Yes" answers: Good foundation—focus on optimisation
- 8-11 "Yes" answers: Address gaps before they become problems
- Under 8 "Yes" answers: Significant risk—prioritise security and backup improvements
How We Researched This Article
This article was compiled using information from authoritative industry sources to ensure accuracy and relevance for Australian businesses.
Sources & References
-
•
ACSC Small Business Guide
Australian Government cyber security guidance for small business
-
•
Essential Eight Maturity Model
ACSC baseline security controls assessment
* Information is current as of the publication date. Cybersecurity guidelines and best practices evolve regularly. We recommend verifying current recommendations with the original sources.
Frequently Asked Questions
How often should we do an IT health check?
Formal review at least annually, with ongoing monitoring of key metrics. After significant changes (new systems, office moves, major incidents), conduct targeted reviews.
Should we get an external IT assessment?
External perspectives identify blind spots. Consider professional assessment every 1-2 years, especially if you don't have dedicated IT expertise internally.
Peer 2 Peer IT
With over two decades of experience in IT solutions for Sydney businesses, Peer 2 Peer IT provides expert insights on technology, security, and digital transformation.
Learn more about us