In this guide · 8 sections
Short answer
A small business IT health check should review accounts and admin access, MFA, devices, backups, licences, domain and DNS, email security and the website, then give you a prioritised list of fixes with evidence. Use CSA's Cyber Essentials areas as the yardstick so the work also counts toward certification.
IT audit vs IT health check: what small businesses actually need
Large companies commission formal IT audits against a standard such as ISO/IEC 27001, often for regulators or auditors. A 5 to 50-person business usually needs something lighter: an independent check of how its IT is set up today, written in plain English, with a list of fixes in order.
The most practical yardstick in Singapore is CSA's Cyber Essentials mark, which groups baseline measures into five areas: Assets, Secure/Protect, Update, Backup and Respond. A health check organised around those areas tells you where you stand and doubles as preparation if you later want the mark. Our Cyber Essentials checklist explains each area.
What an IT health check should cover
Ask any provider for a written scope before you agree. It should include at least these areas:
| Area | What gets checked | Typical finding |
|---|---|---|
| Accounts and access | Admin accounts, MFA, ex-staff accounts, shared logins | A former employee still has a working mailbox |
| Devices | Laptops and phones: updates, encryption, antivirus, screen lock | Two laptops without disk encryption |
| Data and backups | Where files live, sharing links, backup coverage and a test restore | Microsoft 365 or Google data not backed up separately |
| Licences and software | Unused licences, unsupported software, unknown apps with data access | Paying for licences of staff who left |
| Domain and DNS | Who owns the domain, registrar login, renewal, DNS records | Domain registered to a former web agency |
| Email security | SPF, DKIM, DMARC, phishing protection, forwarding rules | No DMARC record; suspicious forwarding rule |
| Website | Hosting access, updates, backups, SSL, admin users | Outdated WordPress plugins, no off-site backup |
| Incident readiness | Who to call, contact list, what to do if hacked | No written plan; the bank's fraud line unknown |
The domain and admin rows are where small businesses most often get a surprise. If the only person with the registrar password has left, fixing that is worth more than any new security product.
Free self-checks to run before you pay anyone
You can do a first pass yourself in an afternoon. The results also make any paid review faster and cheaper.
Microsoft 365: open Secure Score
In the Microsoft Defender portal, Microsoft Secure Score shows recommended actions and how many you have taken. Microsoft notes it is not an absolute measure of breach risk, but the list is a good to-do list.
Google Workspace: work through Google's checklist
Google publishes a security checklist for small businesses. Our Google Workspace security checklist adds the Admin console paths.
List every admin and every account
Export the user list and compare it with your staff list. Disable anyone who has left and remove admin rights from people who don't need them.
Check who owns the domain
Look up the registrar, log in, and confirm the registrant and contact email are yours, with auto-renew on.
Test a backup restore
Restore one file from last week and one website backup to a test location. A backup you have never restored is a hope, not a backup.
Fill in CSA's self-assessment template
The Cyber Essentials page links the template. Answering it honestly shows your gaps in CSA's own terms.
Our Microsoft 365 security checklist and Google Workspace security checklist go setting by setting.
What the report should look like
The deliverable matters more than the hours spent. A 60-page scanner export is not useful to an owner. Ask to see a sample report first.
A useful report
- A one-page summary of the top five risks in plain English
- Each finding has evidence: a screenshot, setting or account name
- Findings ranked by risk and effort, with who should fix each
- Mapped to Cyber Essentials areas so progress is measurable
- Clear separation between what was checked and what was not
Warning signs
- Raw vulnerability scanner output with no prioritisation
- Every finding marked critical
- Recommendations that all point to one vendor's products
- No mention of domain, backups or ex-staff accounts
- Scope so vague you can't tell what was actually checked
Also agree how the provider will access your systems. A read-only admin account created for the review, and removed afterwards, is better than sharing your own password.
Costs and CSA funding
Prices vary with scope and number of users. Two reference points from published sources:
- CSA's CISO-as-a-Service scheme pairs SMEs with CSA-onboarded consultants who assess your set-up and write a cybersecurity health plan toward Cyber Essentials or Cyber Trust. CSA says eligible SMEs can get up to 70% co-funding.
- CSA's provider listing, as summarised in our CISO-as-a-Service guide, showed a median of S$4,000 before funding for 1 to 10 endpoints as of 30 September 2026.
- A narrower health check focused on accounts, email, backups, domain and website is usually a fixed-fee job of a few days.
If you are aiming for certification, the CSA scheme is the natural route. If you mainly want to know what to fix this month, a smaller check followed by targeted fixes is often enough.
Acting on the findings
The point of a health check is the fixes. Most small business reports end up with the same top items, in roughly this order: MFA on every account, removing ex-staff and excess admin access, securing the domain, backing up cloud email and files, turning on automatic updates and disk encryption, then email authentication and website updates.
If the report turns up more than your team can handle, our guide to choosing IT support in Singapore explains the options for ongoing help.
Do it yourself or get help?
The self-checks above catch the biggest problems in most small businesses. Get an outside review when nobody in the business is confident reading admin consoles, after a scare such as a hacked mailbox, before applying for Cyber Essentials, or when a client or insurer asks for evidence.
Our Security Health Check (S$290) reviews your Microsoft 365 or Google Workspace, devices, backups, domain, email and website, and gives you a ranked fix list in plain English. We can carry out the fixes or hand the list to your own IT person.
Frequently asked questions
A useful one covers accounts and admin access, MFA, devices, data and backups, licences and software, domain and DNS ownership, email security and the website, plus whether you have a basic incident plan. The output should be a ranked list of findings with evidence and a clear owner for each fix.
A full review once a year is reasonable for most small businesses, with a quick check of accounts, admin access and backups every three to six months. Also review after big changes such as staff turnover, moving offices, switching email providers or a security incident.
Yes. CSA's CISO-as-a-Service scheme lets eligible SMEs work with CSA-onboarded consultants who assess their set-up and write a cybersecurity health plan toward Cyber Essentials or Cyber Trust, with up to 70% co-funding. Check CSA's page for eligibility and the sign-up process.
It is a measurement in the Microsoft Defender portal of how many recommended security actions your Microsoft 365 tenant has taken, with a list of the remaining actions. Microsoft says it is not an absolute measure of how likely you are to be breached, but it is a useful free to-do list.
No. A health check reviews how your systems are configured and managed, such as accounts, backups and updates. A penetration test has a specialist actively try to break into a specific system, such as a web app. Most small businesses benefit from a health check first and a penetration test only for custom systems.