A security review is a structured look at an organisation’s digital setup to find where it is exposed and what to fix first. It covers the systems the organisation relies on day to day and produces a plain-English list of what needs attention, prioritised by risk.
What a security review covers
A review looks at:
- the website, including software updates, the SSL certificate, user access levels and monitoring
- email, including how the domain is configured to resist spoofing and phishing with SPF, DKIM and DMARC records
- user accounts, including who has access to what and whether two-factor authentication is in place
- cloud tools and storage
- backups, including whether they exist, where they are kept and whether they can be restored
- any other systems the organisation relies on
What the output looks like
The output is a plain-English list of what needs attention, prioritised by risk, with a recommendation for each item. It is written to be read by a leadership team or committee as well as by the person who manages the systems day to day, so decisions about what to fix first can be made without technical translation.
Who a security review suits
A review suits organisations that have never had one, or that are not confident their setup is as secure as it should be. It also suits organisations that have had a security incident and want to prevent a repeat, and organisations whose internal IT support handles day-to-day issues but has not had the time or brief to look at security systematically.
How often a review is needed
Systems, staff and threats change over time, so a review is not a one-off exercise. We carry out biannual reviews for an architectural practice to support its insurance compliance and manage digital risk. A review is also useful after a significant change, such as a new website, a move to a different email platform or the departure of someone with administrator access.
What happens after the review
The findings can be actioned by the organisation’s own IT support, by a web developer or by us. Our Cyber Security & Safety service is typically delivered as a Consulting engagement, which combines the review with hands-on remediation, so the organisation knows exactly where it stands.
Oversight of cyber risk at board or committee level is covered under Technology Governance. For more on where responsibility sits, see Who is responsible for cyber security in an organisation?
