June sits at the natural midpoint of the financial year, and that makes it a practical moment to step back from day-to-day IT operations and assess whether your security posture is still fit for purpose. Most SMEs do not have a dedicated security team, so this checklist is designed to be actionable without requiring specialist expertise — the sort of review you can run through with your IT support provider or managed service partner.

It is not a compliance audit. It is a health check: five areas that tend to drift between January and June, and the steps you can take to reset them before the second half of the year.

Is your patching cadence keeping up?

Software updates are the cheapest form of security available. Yet patching is precisely the area most likely to drift when no one is watching.

What to verify right now

• All workstations and servers have received the latest operating system patches within the past two months.

• Non-company devices (BYOD, contractor laptops) are subject to the same patching expectation as staff machines.

What this means for you

If your IT support provider manages patching, ask for a patch compliance report covering the last quarter. If you are running in-house IT, log into your management console and check the last successful update cycle. The goal is not perfection — it is a consistent rhythm, not a sprint before audit season.

Scheme requirement vs good practice: Cyber Essentials requires that you apply patches within a "reasonable" timeframe. There is no fixed number of days in the scheme baseline, but a two-month gap between critical OS patches would struggle to meet that standard.

Have your backups been tested — not just configured?

Many SMEs have backups. Fewer have tested them in the last six months. There is a meaningful difference between having backup software installed and being able to restore data when you need it.

What to verify right now

• Your last successful backup completed without errors (check the backup logs from the past week).

• You have performed at least one test restore — pulling a file or folder back from backup to confirm the data is usable.

• Your backup retention policy aligns with your business needs and regulatory obligations.

What this means for you

Backup testing is not optional once you factor in ransomware risk. A backup that has never been tested is essentially a hope, not a plan. Schedule a test restore with your IT provider to confirm your restore path works.

Scheme requirement vs good practice: Cyber Essentials does not mandate backup testing, but a maintained backup strategy with tested restores is expected as part of a mature security posture.

Are your access controls actually current?

User access tends to accumulate rather than shrink. When someone leaves or changes role, their old permissions often stay behind like software licenses no one cancels.

What to verify right now

• All former employees and ex-contractors have had their access revoked across email, file shares, cloud services, and financial systems.

• Multi-factor authentication (MFA) is enabled on every user account that supports it.

The practical test

Pick five random user accounts across your systems. For each one, ask: "If this person left today, could they still log in?" If you cannot answer with certainty for all five, your access controls need attention.

Scheme requirement vs good practice: Cyber Essentials explicitly requires MFA on all remote access. Beyond that, extending MFA to every supported account is good practice, because it is the single biggest factor in preventing account takeover.

When was the last phishing test, and what happened?

Phishing remains the most common initial attack vector against UK SMEs. If your organisation has not run a phishing simulation in the last six months, you have no reliable data on how staff would respond to a real attack.

What to verify right now

• A phishing simulation was run in the first half of 2026, or a plan exists to run one this quarter.

• Staff who "clicked" received immediate feedback — not punishment, but a brief educational moment.

What this means for you

Phishing defence is partly technical and partly human. No email filter catches everything. Training that includes regular, realistic simulations produces measurable improvement in staff behaviour — and the cost of a single successful breach far exceeds what a good training programme costs.

Do you have an incident response plan — and does it still work?

Many SMEs have an incident response plan. Even more have one that was written two years ago and has not been reviewed since. Plans age quickly when team members change or systems are replaced.

What to verify right now

• Your incident response plan covers ransomware, data breach, and service outage scenarios.

• Key contacts (insurance broker, senior management, IT support provider) are listed with current phone numbers and emails.

• At least one member of your team has read through the plan in the last six months.

What this means for you

An incident response plan is not a luxury — it is a baseline requirement. If you do not have one, or if the last review was more than six months ago, treat this as your highest priority item. A breached organisation without a plan has a single point of failure.

How to use this checklist

Run through each section once, ideally with your IT support provider or managed service partner. For each area, mark one of three states:

• Current — no action needed right now.

• Needs attention — a small fix or verification within the next few weeks.

• Outdated — review required before the end of Q3.

The goal is not to achieve a perfect score on every item. It is to know where you stand and to have a prioritised list for the next few weeks.

Ready to get started?

If this review surfaces items in the "needs attention" or "outdated" columns, the fastest way to get clarity is a Security Triage Call. It is a structured baseline review that walks through these same areas — patching, access controls, backups, phishing defence, and incident readiness — and gives you a clear picture of where your security stands and what should be addressed first.

Book a Security Triage Call

FAQ

How often should SMEs perform a mid-year IT security review?

At minimum once per year, ideally split into two reviews — one at the half-year point and one before year-end. The June review is particularly useful because it allows you to act on findings while there is still time to implement changes before the autumn.

What is the difference between a security review and a Cyber Essentials assessment?

A security review is an internal health check — it identifies gaps and priorities without formal certification. A Cyber Essentials assessment is a third-party audit against a government-backed scheme standard. The review prepares you for the assessment.

Can a small team with no IT staff complete this checklist?

Yes, if you work with your managed IT support provider. They can run the checks on your behalf and present the findings in plain language. The checklist is designed to be provider-assisted, not provider-independent.

How long does a mid-year security review take?

A focused review across the five areas typically takes 60–90 minutes, depending on the size of your organisation and the complexity of your systems.