Home
/
Resources
/
Checklists

Checklists

Security checklists you can use today

Practical checklists from our security team. Tick items off as you go, see your progress and copy the list into your own tools.

6 checklists
Free to use
Nothing is stored or sent

Security checklists

Choose a checklist

These checklists cover common good practice, drawing on sources such as CIS Controls, OWASP and ISO/IEC 27001. They are a starting point, not a complete assessment. Your ticks are not saved or sent anywhere.

Penetration test readiness

Prepare well and your test will find more, disrupt less and lead to faster fixes.

For IT and security teams

0 of 11 done

Scope and goals

List the systems in scopeIP ranges, domains, applications, APIs and cloud accounts.
Agree why you are testingAudit evidence, a customer request or a new launch shapes the test.
Note anything fragile or off limitsSuch as legacy systems or production databases.

Access and logistics

Sign written authorisationFrom someone with authority over every system in scope.
Check your hosting or cloud provider’s testing policySome providers ask for notice before testing.
Create test accounts for each user roleSo testers can check what each role can reach.
Agree testing windows and an emergency contactIncluding clear stop conditions.

Before testing starts

Take recent backups of systems in scopeA sensible precaution for any change or test.
Decide whether to tell your monitoring teamOr run an unannounced test of detection.
Agree how findings will be shared securelyAnd who should receive the report.
Reserve time for fixes and a retestAgree owners and target dates in advance.

Get expert help: VAPT

Cloud security basics

The basics that prevent most cloud incidents on AWS, Microsoft Azure and Google Cloud.

For cloud and DevOps teams

0 of 11 done

Identity

Enforce MFA for every person with cloud accessEspecially administrators.
Stop using root or owner accounts day to dayKeep them locked away for emergencies.
Remove unused users, roles and access keysOld credentials are a common way in.
Give roles and service accounts least privilegeOnly the permissions each one needs.

Data

Check no storage or database is public by mistakeReview buckets, blobs and snapshots.
Turn on encryption at restFor storage, databases and backups.
Keep secrets in a secrets managerNever in code, images or pipelines.

Network and visibility

Close SSH and RDP to the internetUse a bastion, VPN or managed access instead.
Enable audit logs in every account and regionAnd keep them where attackers cannot delete them.
Alert on high-risk changesSuch as new admin users or disabled logging.
Set billing alertsUnexpected usage can be a sign of compromise.

Get expert help: Cloud posture assessment

ISO 27001 & SOC 2 audit readiness

Check you have the foundations, controls and evidence in place before the auditor arrives.

For compliance and security leads

0 of 12 done

Foundations

Define the scopeThe ISMS scope for ISO 27001, or the system description for SOC 2.
Name an accountable owner with leadership supportSomeone who can make decisions and secure budget.
Complete a risk assessment and treatment planLinked to the controls you choose.
Prepare a Statement of ApplicabilityRequired for ISO 27001.

Policies and controls

Approve and share your core policiesSuch as security, access control, incident response and suppliers.
Run and record access reviewsFor critical systems and privileged accounts.
Track security awareness trainingFor every employee, including new joiners.
Assess your key suppliersEspecially those that handle your data.

Evidence and audit

Collect evidence for the whole audit periodSOC 2 Type 2 covers a period of operation.
Complete an internal audit and management reviewBoth are required before ISO 27001 certification.
Run a readiness review or mock auditTo find gaps while there is time to fix them.
Choose your auditor and book datesAn accredited certification body or a licensed CPA firm.

Get expert help: ISO 27001 & SOC 2 readiness

Ransomware readiness

Make an attack harder, and make sure you can recover quickly if one gets through.

For IT teams and leadership

0 of 11 done

Prevent

Enforce MFA on email, remote access and admin accountsStolen passwords are a leading way in.
Patch internet-facing systems quicklyPrioritise vulnerabilities known to be exploited.
Run endpoint detection on laptops and serversAnd make sure someone responds to alerts.
Do not expose RDP directly to the internetUse a VPN or secure gateway with MFA.

Recover

Keep offline or immutable backupsOut of reach of an attacker with admin access.
Test restores regularlyA backup only counts if you can restore it.
Agree recovery targets for critical systemsHow long you can be down, and how much data you can lose.
Separate backup admin accountsFrom your everyday domain accounts.

Respond

Write an incident response planWith roles, decisions and contact details.
Run a tabletop exercisePractise the plan with leadership and IT.
Know who you must notify, and how fastRegulators, customers and insurers may set deadlines.

Get expert help: Business continuity & DR

Web application launch

Security checks to complete before a new application, portal or API goes live.

For product and engineering teams

0 of 12 done

Build

Check authorisation on the server for every requestSo users cannot reach other users’ data.
Limit login attempts and offer MFATo slow down password guessing.
Validate input and encode outputTo prevent injection and cross-site scripting.
Keep secrets out of front-end code and repositoriesIncluding API keys and tokens.
Scan dependencies for known vulnerabilitiesAnd update before launch.

Configure

Serve everything over HTTPS with HSTSCheck your TLS setup is current.
Add security headersSuch as Content-Security-Policy and X-Content-Type-Options.
Turn off debug mode and detailed errorsIn production.
Protect admin interfacesRestrict access or put them behind MFA.
Log security eventsLogins, failures and permission changes.

Verify

Test the application independently before launchIncluding business logic and APIs.
Fix and retest critical and high findingsBefore go-live.

Get expert help: Web & API testing

Joiners, movers and leavers

Keep access right as people join, change roles and leave, one of the most common audit findings.

For IT and HR teams

0 of 11 done

Joiners

Create accounts only from an approved requestWith a record of who approved it.
Grant access by roleNot by copying another person’s account.
Enrol MFA on day oneBefore any sensitive access is used.
Complete security awareness trainingAs part of onboarding.

Movers

Review access when someone changes roleAdd what the new role needs.
Remove access the new role does not needSo permissions do not pile up over time.

Leavers

Disable accounts on the last working dayStarting with single sign-on.
Revoke VPN, cloud and SaaS accessIncluding personal access tokens and API keys.
Change shared passwords they knewAnd move shared secrets to a password manager.
Recover and wipe devicesAnd transfer ownership of their files.

Ongoing

Review access to critical systems regularlyPrivileged accounts more often than others.

Get expert help: IAM security

Go further

Want an expert to check it for you?

A checklist shows what to look for. Our specialists verify it, find what checklists miss and help you fix it.

Request an assessment Read our guides