If your business has not reviewed its cybersecurity controls in the last 12 months, there is a good chance you have security gaps you are unaware of. Recent Kaspersky research found that 78% of South African SMBs experienced at least one cybersecurity incident in the past year, with social engineering, phishing, stolen credentials, and business email compromise among the most common threats. Reviewing a small number of critical controls before year-end can significantly reduce your risk and improve your resilience.

When This Is the Right Choice / When It Isn’t

This checklist is designed for South African businesses with between 10 and 250 employees that rely on email, cloud applications, Microsoft 365, customer data, and internet-connected devices.

It is particularly relevant if:

• Your business has grown during the last year.
• Staff work remotely or in a hybrid environment.
• You have never conducted a formal cybersecurity review.
• You need to comply with POPIA requirements.

If you already have a dedicated security team, annual penetration testing programme, and documented cyber governance framework, this checklist may simply act as a validation exercise.

The 7-Step Cybersecurity Checklist

1. Is Multi-Factor Authentication Enabled Everywhere?

Passwords alone are no longer sufficient protection.

According to Kaspersky’s 2026 South African SMB research, weak or stolen credentials remain one of the most common causes of security incidents. Cybercriminals increasingly purchase compromised passwords from dark web marketplaces or obtain them through phishing attacks.

Review:

• Microsoft 365 accounts
• VPN access
• Remote desktop access
• Cloud applications
• Administrative accounts

If MFA is not enabled everywhere possible, this should be your highest priority.

2. Have You Tested Your Backups Recently?

Many businesses know backups are running.

Far fewer know whether recovery actually works.

A modern backup strategy should include:

• Daily backups
• Offsite copies
• Recovery testing
• Ransomware protection

Businesses relying on backup reports without recovery testing are operating on assumptions rather than evidence.

3. Do You Know Which Employees Represent the Highest Risk?

Cybersecurity is increasingly becoming a people challenge rather than a technology challenge.

ASG’s Human Risk Management approach focuses on measuring employee risk through training, phishing simulations, and behavioural monitoring rather than relying solely on annual awareness sessions.

Ask yourself:

• Could employees identify a phishing email?
• Would finance staff recognise payment fraud?
• Are executives prepared for impersonation attacks?

If you do not know the answers, you have an unmanaged risk.

4. Are Your Microsoft 365 Accounts Properly Secured?

Many SMEs assume Microsoft 365 is secure by default.

In reality, security depends on how it is configured and managed.

Review:

• MFA status
• Administrator privileges
• External sharing permissions
• Conditional access policies
• Suspicious sign-in monitoring

Microsoft 365 is often one of the most targeted systems within an SME environment.

5. Are All Devices Receiving Security Updates?

Attackers frequently exploit known vulnerabilities that already have available fixes.

Review:

• Windows updates
• Application updates
• Firewall firmware
• Network infrastructure
• Endpoint protection status

If devices are not being monitored and updated consistently, vulnerabilities can remain exposed for months.

6. Do You Have Visibility Into Shadow IT?

Shadow IT refers to software and cloud services employees use without IT approval.

Recent Kaspersky research highlights the growing use of unauthorised tools, including AI applications, within SMB environments. Attackers are increasingly disguising malware as legitimate AI tools and services.

Review:

• File sharing platforms
• AI tools
• Password managers
• Browser extensions
• Collaboration applications

You cannot secure systems you do not know exist.

7. Do You Have an Incident Response Plan?

Most businesses spend time planning for operational disruptions but never document how they would respond to a cyber incident.

An effective incident response plan should answer:

• Who makes decisions?
• Who contacts customers?
• Who communicates with suppliers?
• How are systems recovered?
• When are legal obligations triggered under POPIA?

When an incident occurs, clarity saves time.

Costs or Effort Ranges

For a typical South African SME, improving these controls generally involves: