Plan a security review

Editorial update: 21 September 2026. Introductory learning material.

A security review should have an agreed scope, criteria, owner and evidence plan. A checklist alone does not establish compliance or replace a specialist assessment.

1. Define the systems, business processes and requirements in scope.
2. Confirm written authorization before any scanning or testing; agree limits, timing and recovery arrangements.
3. Review inventories, access, update practices, backup tests and incident arrangements.
4. Compare documented controls with evidence of how they operate.
5. Record findings, impact, owners and proposed actions.
6. Verify completed actions and retain the evidence.

Activity: Draft a one-page scope for a review of one business process. Identify where specialist technical or regulatory expertise is needed.

Reference: NIST small-business cybersecurity framework resources. Check the source and your system provider’s current instructions before implementation.