Checklist

SME Cybersecurity Checklist

A practical checklist for South African small and medium enterprises to assess and improve their cybersecurity posture.

Synaptic Technologies · v1.0 · 2026

Cyber threats are no longer a concern reserved for large corporations. South African SMEs are increasingly targeted because they often lack the security controls of larger organisations. Use this checklist to identify gaps and take immediate action.

Access Control & Identity Management

All user accounts are protected with strong, unique passwords (minimum 12 characters).

Multi-factor authentication (MFA) is enabled on all business email accounts.

MFA is enabled on all cloud services (Microsoft 365, Google Workspace, AWS, etc.).

A formal process exists for onboarding and offboarding staff accounts.

Former employees' accounts are disabled or deleted within 24 hours of departure.

Admin/privileged accounts are separate from standard user accounts.

Shared passwords are not used across multiple staff members.

Email Security

Email filtering is in place to block spam, phishing, and malicious attachments.

Staff have been trained to identify phishing and Business Email Compromise (BEC) attempts.

SPF, DKIM, and DMARC DNS records are configured for your email domain.

A process exists to verify unusual payment or banking detail change requests via a secondary channel (phone call).

Email archiving is enabled and retained for a minimum of 12 months.

Endpoint & Device Security

All company devices have up-to-date antivirus/endpoint protection software installed.

Operating systems and software are patched and updated regularly (at least monthly).

Full-disk encryption is enabled on all laptops and mobile devices.

A mobile device management (MDM) solution is in place for company-owned devices.

USB and removable media usage is restricted or monitored.

A policy exists for personal devices used for work (BYOD).

Network Security

A business-grade firewall is in place and actively managed.

Guest Wi-Fi is on a separate network from the corporate network.

Default router/switch passwords have been changed.

Remote access (VPN) is required for staff accessing internal systems from outside the office.

Network activity is logged and reviewed periodically.

Data Backup & Recovery

Critical business data is backed up daily.

Backups are stored offsite or in a separate cloud environment (not on the same system).

Backup restoration has been tested in the last 6 months.

Backups are encrypted.

A documented recovery time objective (RTO) and recovery point objective (RPO) exists.

POPIA & Data Privacy

A Privacy Policy is published on your website and kept up to date.

Personal information of customers and staff is stored securely and access is restricted.

A process exists to respond to data subject access requests within the required timeframe.

A data breach notification procedure is documented and staff are aware of it.

An Information Officer has been designated and registered with the Information Regulator.

Staff Awareness & Training

All staff have received cybersecurity awareness training in the last 12 months.

New employees receive cybersecurity training as part of onboarding.

Staff know how to report a suspected security incident.

Phishing simulation exercises have been conducted.

An acceptable use policy (AUP) for IT systems has been signed by all staff.

Incident Response

A documented Incident Response Plan (IRP) exists.

Key contacts (IT support, legal, insurance) are documented and accessible.

Staff know who to contact first in the event of a cyberattack.

Cyber insurance coverage has been reviewed and is in place.

How Did You Score?

Count the number of items checked. Use the guide below to assess your current posture:

0–10Critical Risk

Immediate action required. Your business is highly vulnerable to a cyberattack.

11–20High Risk

Significant gaps exist. Prioritise the unchecked items as a matter of urgency.

21–30Moderate Risk

A reasonable foundation exists but important controls are still missing.

31–38Low Risk

Good security posture. Continue to review and improve regularly.

This checklist is provided for informational purposes by Synaptic Technologies. It does not constitute a formal security audit. Contact us at [email protected] for a professional assessment.

Need a Professional Assessment?

Our team can conduct a thorough cybersecurity assessment of your business and help you close the gaps.