Security Baseline Checklist for Companies With 20 to 200 People

Most attacks on growing companies don't need anything clever. They succeed because a basic control was missing. Use this checklist to see where you stand. If you can't answer "yes" with confidence, treat it as a gap.

Accounts and access

• Multi-factor sign-in is on for every account, including email, admin accounts and remote access, with no exceptions left over from setup.
• Admin rights are limited to the few people who need them, and those people use a separate admin account.
• Former employees and contractors have no access. Accounts are disabled the day someone leaves.
• Passwords are managed, with a company password manager instead of shared spreadsheets or browser notes.

Devices

• Every laptop and phone used for work is enrolled in device management, so it can be locked or wiped if lost.
• Disks are encrypted on laptops.
• Updates are applied, not just available, on operating systems and common apps.
• Only approved software can run, which stops most ransomware before it starts.

Email and web

• Email is filtered for phishing, malware and spoofed senders.
• Your domain is protected against spoofing, so attackers can't easily send email that looks like yours.
• Risky websites are blocked for company devices.
• Payment changes are verified by phone, using a number you already have, never one in the email.

People

• Everyone gets short, regular security training, not just a one-time video.
• You run phishing tests, and people know how to report a suspicious email.

Backup and recovery

• Critical data is backed up, including Microsoft 365 or Google Workspace email and files.
• Restores are tested. A backup that has never been restored is a guess.
• At least one backup copy can't be changed or deleted by an attacker who gets into your network.

Ownership and proof

• One person or partner owns security day to day.
• You have written basic policies: acceptable use, access, passwords and incident response.
• You can show evidence of these controls when an insurer, client or auditor asks.

How to use this list

Count your gaps. One or two can usually be fixed in weeks. Five or more usually means nobody owns security yet, which is the real problem to solve.

Elevaire Managed Security puts this baseline in place and keeps it enforced, for one predictable monthly price. For a scored version of this checklist, take the free security scorecard.