Quarterly Security Review Checklist
A quarterly security review checklist for small IT teams: check MFA, admin accounts, patches, backups, alerts, domains and open risks in about an hour.
- Typical schedule quarterly
- The checklist 5 sections, 20 items
- Variables
{{quarter}}
Auf Deutsch lesen: IT-Sicherheit-Checkliste für KMU (Quartals-Review)
Use this checklist once a quarter to catch the security drift that builds up between audits: a new admin account nobody removed, a laptop that stopped updating, a domain about to expire, an alert rule that went silent. It is a hygiene check for small companies without a full security team, and it should take a focused hour or two, not a week.
Who owns it
An IT, operations or engineering lead owns the run. Some checks need a second person, such as the finance admin for payment accounts or a developer for dependency alerts. Assign those items in the run. Adapt this to your jurisdiction and policies; it is a practical checklist, not legal advice.
Common pitfalls
- Checking the dashboard, not the gaps. "MFA is on" in an admin console can still allow exceptions. Look at the list of users without MFA, not the policy setting.
- Trying to fix everything during the review. The review is for finding problems. Create tickets and fix the bigger items in normal work.
- Skipping the boring items. Domain renewals, recovery codes and break-glass accounts are rarely urgent until the day they cause an outage.
- No trend. Compare with last quarter's run so recurring issues become visible.
Schedule the checklist in Runbook for the first week of each quarter. Each run then shows what was checked and by whom, which also helps during a SOC 2 or ISO 27001 audit.
The checklist: Quarterly security review {{quarter}}
Identity and access
-
Confirm every user in the identity provider has MFA enrolled
Look at the list of exceptions or users without a second factor, not only the policy setting.
-
Review the list of admins in the identity provider, cloud accounts and code hosting
-
Remove accounts of people who left during
{{quarter}}in all tools, including those outside SSO -
Test that break-glass or emergency admin accounts still work and are stored securely
Devices and software
-
Check that all company laptops have disk encryption and current OS updates
-
Check that endpoint protection is active and reporting on all devices
-
Review open dependency and container vulnerability alerts and assign critical ones
-
Confirm servers and managed services are on supported versions
Data and backups
-
Confirm backups ran successfully during
{{quarter}} -
Restore one backup to a test environment and check the data
-
Review publicly shared files, links and storage buckets and remove unneeded sharing
Monitoring and external exposure
-
Send a test alert and confirm it reaches the on-call person
-
Review audit logs for unusual admin activity optional
-
Check domain and TLS certificate expiry dates for the next six months
-
Check SPF, DKIM and DMARC records for each sending domain
-
Run an external scan of public IPs and hostnames and compare with last quarter optional
Risks and follow-up
-
Review the risk register and update risks that changed in
{{quarter}} -
Review open security tickets and exceptions, and close or re-approve them
-
Record findings from this review as tickets with owners
-
Share a short summary with management
Checklist as Markdown
Frequently asked questions
What should a quarterly security review cover?
Focus on things that drift: user accounts and MFA, admin rights, device updates, vulnerability alerts, backups, alerting and public exposure such as shared links or open ports. Add any recurring control your policies or customers require. Keep it short enough that it actually gets done every quarter.
Is a quarterly security review the same as an access review?
No, but they overlap. An access review checks each user's access to each system in detail, with sign-off from managers. The quarterly security review is a broader hygiene check. Many teams run both in the same week.
Who should do the quarterly security review in a small company?
Usually the person responsible for IT or infrastructure, with help from whoever administers finance and HR tools. If one person does everything, have someone else look over the results now and then, so blind spots get caught.
Updated