In this guide · 8 sections
- 01Why a monthly cyber hygiene routine works
- 021. Security alerts and Secure Score (5 minutes)
- 032. Backups: did they run, and can you restore? (5 minutes)
- 043. Leavers, unused accounts and admin roles (3 minutes)
- 054 to 6. Renewals, updates and a staff reminder (7 minutes)
- 06The printable monthly checklist
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Once a month, check six things: security alerts and score, backups actually ran, leavers are removed, domain and SSL expiry dates, devices are updated, and one short reminder to staff. Each takes two to five minutes; the ticked list doubles as evidence for Cyber Essentials or cyber insurance.
Why a monthly cyber hygiene routine works
Cyber hygiene means the routine habits that keep systems in a safe state: accounts tidy, software updated, backups working. CSA's Cyber Essentials mark is built on five areas: Assets, Secure/Protect, Update, Backup and Respond. A monthly check covers a slice of each.
The point is not to find attacks in progress. It is to notice drift: the setting someone switched off, the new laptop nobody enrolled, the ex-employee whose mailbox still forwards to Gmail. These are cheap to fix in week one and expensive in month six.
| Check | Time | Cyber Essentials area |
|---|---|---|
| Security alerts and score | 5 min | Secure/Protect, Respond |
| Backups ran, one test restore | 5 min | Backup |
| Leavers and unused accounts | 3 min | Assets, Secure/Protect |
| Domain, SSL and renewals | 2 min | Assets |
| Device and software updates | 3 min | Update |
| One staff reminder | 2 min | Assets (people) |
1. Security alerts and Secure Score (5 minutes)
Start where your email platform already tells you about problems.
- Microsoft 365: open Microsoft Secure Score in the Microsoft Defender portal. Note the score, then look at the history: a drop means a setting changed. Open the Incidents and alerts page and read anything new.
- Google Workspace: open the Alert center in the Admin console under Security. Look for suspicious sign-ins, leaked password warnings and new admin roles. The security health page is only in Enterprise and some Frontline editions, so Business plan users rely on the Alert center.
Do not chase a perfect score. Microsoft shows every possible recommendation, including ones your licence does not cover. What matters is that MFA stays on for everyone, admin accounts are few, and the score is not falling.
2. Backups: did they run, and can you restore? (5 minutes)
Open your backup tool's dashboard and confirm the last successful backup for each item: Microsoft 365 or Google mailboxes and files, your website, your accounting data and any shared drive or NAS. Failed jobs often fail silently for weeks because the alert email goes to someone who left.
Then restore one file to a test folder. Pick a different source each month, such as one mailbox item, one website file or one spreadsheet from a shared drive. If you have no third-party backup for Microsoft 365 or Google Workspace, our guide to backing up Microsoft 365 and Google Workspace explains why the built-in recycle bins are not enough.
3. Leavers, unused accounts and admin roles (3 minutes)
Open the user list in the Microsoft 365 or Google admin console and compare it with your staff list. Any account belonging to someone who left should be blocked, and its mailbox converted or archived.
- Last sign-in dates. Sort by last sign-in. An account nobody has used for 30 days is either a leaver, a shared login or a forgotten test account. Microsoft documents how to find inactive accounts in Entra ID.
- Admin roles. Count the global or super admins. Two is normal for a small business: one person and a break-glass account. More than that needs a reason.
- Forwarding rules. Check that no mailbox forwards everything to an outside address, a common sign of a past compromise.
- Other apps. Accounting, payroll, website admin, banking and social media logins also need the leaver removed.
Once a quarter, go deeper with a full access review that asks each manager to confirm who can see what.
4 to 6. Renewals, updates and a staff reminder (7 minutes)
Domain, SSL and subscription renewals
Check the expiry date of your domain at your registrar and confirm auto-renew is on with a working card. Most website certificates now renew automatically, so check the padlock still shows and the certificate is not within two weeks of expiry. Glance at renewal dates for security tools, antivirus and backup subscriptions; a lapsed licence quietly turns protection off.
Device and software updates
Look at your device management or antivirus console for machines that are behind on updates or have not checked in. Without a console, ask each person to confirm Windows Update or macOS Software Update shows no pending restart. Phones count too. Our guide to software updates and patching for small businesses covers how to automate this.
One staff reminder
Send one short message to the team. Rotate topics: how to report a suspicious email, never approving an MFA prompt you did not start, checking bank details by phone before paying a new invoice, or a scam currently in the news.
The printable monthly checklist
Copy this into a shared document or task app with a monthly reminder. Write the date, your initials and anything you fixed.
Monthly cyber hygiene check
If something on the list needs more than 10 minutes, note it and book a separate time to fix it. The check stays quick, and you have a written trail of what was found and done, which CSA's Cyber Essentials assessment and our Cyber Essentials checklist both expect.
Do it yourself or get help?
A business owner with admin access can run this checklist alone. The harder part is fixing what it finds, and keeping it going when the business gets busy.
If you want a one-off baseline first, our Security Health Check (S$290) reviews your domain, website, email and Microsoft 365 or Google settings and gives you a ranked fix list. To hand the monthly routine over, Protect Essentials (S$9 per user a month, minimum 3 users) covers the MFA and sharing checks, joiners and leavers, and a monthly plain-English security report. It is not a 24/7 monitoring service.
Frequently asked questions
Cyber hygiene is the routine upkeep that keeps your systems in a safe state: removing old accounts, keeping MFA on, updating devices, checking backups and renewing domains and security subscriptions. It does not need special tools. A short monthly checklist covers most of the gaps that lead to small business incidents.
A quick check each month, a fuller access review each quarter, and a yearly review of policies, incident plans and insurance works for most small businesses. Act straight away when someone leaves, a device is lost or a supplier reports a breach, rather than waiting for the monthly check.
Microsoft Secure Score is in the Microsoft Defender portal. Sign in with an admin account and open Secure Score. It shows a percentage, a history chart and recommended actions. Watch for drops rather than chasing a perfect score, because it lists recommendations for products you may not license.
Google Workspace's security health page compares your settings with recommendations, but Google lists it only for Enterprise, Education, Frontline and Enterprise Essentials Plus editions. On Business Starter, Standard or Plus, use the Alert center in the Admin console for suspicious sign-ins and leaked passwords, and review settings manually.
It supports it. CSA's Cyber Essentials mark covers Assets, Secure/Protect, Update, Backup and Respond, and assessors expect evidence that controls are maintained. A dated monthly checklist with notes of what you fixed is useful evidence, but certification still requires the full self-assessment and a check by an appointed certification body.