SME cybersecurity audit
An SME cybersecurity audit that ends in an action plan.
A security audit for an SME is only worth something if it ends in prioritised actions. The SME Security Baseline reviews identities and two-step verification, email and domain (SPF, DKIM, DMARC), critical SaaS and privileges, backups, devices, suppliers and incident preparedness. It ends with ranked findings and a remediation plan by horizon. From CHF 990, quoted; it is neither a penetration test nor a certification.
Reviewed on by Danilson Ramos · version 1.0
What you can do today (free)
- Turn on multifactor authenticationEmail and administrator accounts first.
- Back up regularlyAnd test a restore: a backup never restored remains an assumption.
- Install updatesSystems, applications, network equipment.
- Be wary of unusual emailsEspecially requests for a payment, changed bank details or a code.
- Use secure passwordsUnique, kept in a password manager.
What not to do
- Don’t buy a catalogue of tools before knowing what actually exposes you.
- Don’t mistake a completed checklist for compliance or certification.
- Don’t run any active test on a system without its owner’s written authorisation.
When an audit is useful
- After an incident, to know what remains exposed.
- Before answering a customer’s or insurer’s security questionnaire.
- Two-step verification is not on everywhere.
- Backups were never actually restored.
- Nobody knows exactly who administers what.
- The company is growing and access was granted along the way.
The legitimate options
The NCSC’s first steps
Five baseline measures for companies: multifactor authentication, backups, updates, caution with unusual emails, secure passwords.
The ICT minimum standard
Recommended to all organisations as guidance; mandatory only in some sectors (electricity, gas). The NCSC has been responsible for it since March 2024.
NIST CSF 2.0 and CIS Controls v8.1
The international frameworks that structure the assessment — with no certification attached.
When a specialist helps
- You have no in-house security expertise.
- You want a view independent from your IT provider.
- You must prioritise on a limited budget.
- A customer or partner asks for evidence of your measures.
SME Security Baseline
The SME Security Baseline
from CHF 990
A confidential request, a written scope and a fixed price before any work. The assessment is mostly remote, through read access or shared sessions — never passwords by email.
- Identity and access review, two-step verification coverage
- Business email protection, domain and DNS (SPF, DKIM, DMARC)
- Critical SaaS configuration and administrator privileges
- Backup readiness for a real restore
- Device management, supplier exposure, incident preparedness
- Prioritised findings with risk context and remediation actions
Limits
- No penetration test: active testing requires signed rules of engagement and a separate quote.
- No certification or compliance attestation.
- Findings depend on the access and information provided; what was not reviewed is stated.
- Remediation is quoted separately.
- No penetration test
- No certification or compliance attestation
- Remediation quoted separately
Frequently asked questions
Is it a penetration test?
No. The baseline reviews configuration and organisation. A penetration test requires signed rules of engagement, a precise scope and a separate quote.
Will we get a certification?
No. The deliverable is a report of prioritised findings and a remediation plan. No checklist amounts to a certification.
How long does it take?
It depends on size and the number of systems; the timing is in the proposal, based on real capacity.
What do you need from us?
An authorised person, read access or shared sessions with your administrator, and the list of your critical tools. No secrets by email.