FREN

Security / Tool

Home / Security

Security audit for a small organisation: 80-point checklist, score and report

A ready-to-use audit checklist for small businesses, non-profits and practices: 80 checkpoints across 12 areas, tailored to the organisation's actual scope, each with the why, how to check and the recommended action. Weighted score per area, prioritised action plan and a report you can print to PDF.

Security Tool Intermediate Published October 21, 2026 Translated October 27, 2026 8 min read Version française
Hand holding a pen above a blue clipboard
Photo: Phil Hearing on Unsplash

In plain words

A security audit is like a car's roadworthiness test: you go through a list of points known in advance, note what is fine, what is borderline and what is dangerous, and leave with the list of repairs, most urgent first. This checklist does the same for a small organisation's IT: you answer on site, and the tool works out the score and writes the action plan and the report.

Before you start

  • Allow half a day to a full day depending on the organisation's size: an interview with the manager and the person who looks after IT, then a walk round the premises and a few checks on computers and consoles.
  • Tick the scope first: questions about the server, Active Directory, Wi-Fi or the website only appear if the organisation has them.
  • Check rather than ask. Each question has a "How to check" section with the command or screen to look at. A "yes" that is declared but not checked is better marked as "Partly".
  • Write down your findings in the field provided: they are carried over as-is into the action plan and the report.

The checklist was written from French guidance (ANSSI, the national cybersecurity agency, and the CNIL, the data protection authority). The measures apply everywhere; where a step names a French body, use your country's equivalent: national cyber helpline, data protection authority, certified health data hosting.

How the score is calculated

Answer Points scored
Yes The checkpoint's full weight
Partly Half
No, Don't know Zero
Not applicable Left out of the calculation

Each checkpoint is weighted by its criticality: critical 3, important 2, recommended 1. An area's score is the share of points scored out of the points available.

Overall level Score
Under control 85% and above
Fair 70 to 84%
Needs work 50 to 69%
Inadequate 30 to 49%
Critical below 30%

One open critical item caps the level at "Needs work", and three critical items cap it at "Inadequate", whatever the percentage. An organisation that is perfect everywhere except offline backups is not protected against ransomware, and the score must not suggest otherwise.

The action plan

Priority Content Suggested timeframe
P1 Critical items answered "No" or "Don't know", and partly met critical items that are quick to fix Within a month
P2 Other partly met critical items, important items Within three months
P3 Recommended items Within a year

Within each priority, quick actions come first: they raise the level straight away and keep motivation up. Fill in an owner and a due date for each line before printing the report: a plan with no names or dates ends up in a drawer.

Keeping and following up the audit

  • Answers are kept in this browser only: nothing is sent over the internet. On a shared computer, use "New audit" at the end to erase them.
  • Save the audit produces a file to keep in the client's or organisation's folder. "Open an audit" reloads it later so you can complete it.
  • Compare with a previous audit loads the old file: the results show a marker on each bar and the change in points. Repeat the audit every year, or six months after handing over the action plan.
  • The action plan can also be downloaded as CSV, to track it in a spreadsheet or import it into a ticketing tool.
  • Print the report produces a clean document: audit details, summary, immediate priorities, action plan, detail of the 80 checkpoints and method. Choose "Save as PDF" as the printer to get a file.

What this audit is not

It is a self-reported, organisational audit carried out in one go: it replaces neither a penetration test, nor a detailed configuration audit, nor legal support with GDPR. It gives a faithful snapshot of the basic measures, those that prevent the vast majority of incidents in small organisations, and shows where to focus effort first.

Going further

Several checkpoints have their own detailed guide on the site: The 3-2-1 backup rule, Two-factor authentication and FIDO2 keys, Password managers, the VLAN planner to keep devices apart, and Installing GLPI to keep the inventory.

Sources

Read next