Most SMEs review their tax systems before April. Far fewer review their IT security. That is a gap — and not an abstract one.

When a prospective client requests evidence of your security posture for a tender, when an insurer asks whether your controls are current, or when Cyber Essentials is on your renewal calendar, the answer depends on whether you have reviewed your security intentionally — and whether you can produce evidence that the review actually happened.

This article is a practical IT security review checklist for owner-managed UK SMEs with roughly 10 to 25 people. It covers what to verify during February so that when the tax year changes, your security baseline is documented, current and defensible.

Why does an IT security review matter before the tax year change?

The 6 April date does not create security risks. It creates a deadline. Any business that operates under time pressure from March through May — responding to tenders, renewing insurance, preparing for audits — does not have the luxury of discovering that its security controls have drifted.

An IT security review is a structured check of the protections you rely on. It asks whether your controls are still in place, whether they have been updated against current threats, and whether you can demonstrate that someone owns each area.

For most SMEs, February is the latest sensible month to complete that review. Any later and you are working against the same deadline pressures that make evidence-gathering difficult.

What should a pre-tax-year security review cover?

A focused review does not need to be exhaustive. It needs to check five areas that, when combined, cover the core of what any reasonable auditor, insurer or prospective client will ask about.

1. Identity and access controls

Identity management is the first line of defence for most SMEs. A review of your identity posture asks three practical questions: who can access your systems, who should still have access, and is the access properly protected?

Review steps:

• Confirm every employee who left in the past six months has had all accounts disabled across Microsoft 365, shared drives, cloud applications and admin consoles

• Identify any shared or service accounts — they are often the weakest link because no single person owns them

• Verify that multi-factor authentication (MFA) is enabled for every account with access to business data

• Review admin privileges: are there more users with elevated access than is actually necessary?

The NCSC identifies stronger sign-in protection — including MFA and regular access reviews — as fundamental controls for small businesses. These are not optional extras. They are the baseline against which assessors, insurers and auditors measure your organisation.

If you cannot produce a clean, up-to-date list of active accounts within a few minutes, access control needs attention.

2. Patching and device standardisation

Outdated software is one of the most common entry points for automated attacks. A patching review verifies that your devices are being kept current and that this is happening systematically, not through individual initiative.

Review steps:

• Confirm all business devices are running supported operating systems

• Check that critical and high-security updates are being applied consistently, not sporadically

• Verify that update failures are flagged and actioned — not silently ignored

• Confirm that any unsupported devices have a documented replacement or decommissioning plan

Windows 10 reached end of support in October 2025. For businesses still running Windows 10 devices, this is not a theoretical risk — it is a device that no longer receives security patches from Microsoft. Before the tax year changes, this is a decision that needs to be documented.

The NCSC's guidance on vulnerability management for small organisations includes keeping software up to date as one of the core responsibilities. Unsupported software does not create a good impression with any third party reviewing your systems.

3. Email security posture

Email remains the primary attack surface for most SMEs. A weak email authentication setup means anyone on the internet can send messages that appear to come from your domain. That is not a hypothetical risk — it is the mechanism behind the vast majority of business-targeted phishing campaigns.

Review steps:

• Confirm SPF is configured for your primary domain

• Verify that DKIM is enabled

• Check that DMARC is in place, at least in monitoring mode (p=none) before moving to enforcement

• Review inbox rules on finance and senior management accounts — rules can be set by a single compromised account

Microsoft's own guidance on email security treats SPF, DKIM and DMARC as essential foundation steps. Without them, your domain cannot distinguish between your legitimate email and someone impersonating it.

A quick check of DMARC monitoring mode is a good starting point. It tells you whether email authenticated correctly without risking delivery failures that can occur if you switch to enforcement mode without having all your sending sources mapped first.

4. Backup and recovery readiness

Backups are not one of the five official Cyber Essentials technical controls. They are, however, one of the first things any insurer or prospective client will ask about, and they represent the difference between a recoverable incident and a business-ending one.

Review steps:

• Verify what data is actually being backed up — Microsoft 365 mailbox data, SharePoint, OneDrive, local files, or just a subset

• Confirm the last backup run completed successfully

• Verify that a restore test has been performed recently — a backup that has never been restored to proves nothing

• Check that backup failures or gaps are tracked to resolution

Microsoft 365 retention features and recycle-bin tools are platform-level safeguards. They are not a substitute for an independent backup copy. If your backup data lives inside the same Microsoft 365 tenant, it is reachable by the same credentials and the same threat actor. An independent backup held outside the tenant is what makes recovery genuinely resilient.

The NCSC includes backup and recovery as a fundamental technology area for small businesses. The practical question for any SME is whether that backup can actually be used when needed — and testing restores is the only way to answer that.

5. Evidence and documentation readiness

A security review is only as useful as the evidence that it happened. If your controls are strong but you cannot demonstrate them, the review has not achieved its purpose.

Review steps:

• Compile a current device and asset inventory — who owns what, where it sits, which operating system it runs

• Document who owns each security area: patching, access management, backup, email security

• Maintain a written record of the February review itself: what was checked, what was found, what actions were taken

• Ensure your Cyber Essentials certification (if held) is current — certificates expire after 12 months

This is not a full Cyber Essentials assessment. It is a practical check that you can answer three questions clearly: what do we protect, who is responsible for it, and can we prove it when asked?

How does this relate to Cyber Essentials?

February is not a Cyber Essentials deadline. But it is a sensible month to check whether the five technical controls — firewalls, secure configuration, security update management, user access control and malware protection — are maintained throughout the year rather than prepared once a year for an assessment.

Cyber Essentials is the minimum standard of cyber security recommended by the UK Government. If you hold certification, February is a good month to pull together a basic evidence pack and confirm that nothing has drifted since your last assessment. If you do not yet hold Cyber Essentials, this review will show you where your gaps are — and the starting point for understanding those gaps is a Security Triage Call, where Infinite Cloud IT can assess your baseline without commitment.

IT security review before tax year: FAQ

What exactly is an IT security review, and how is it different from a routine IT check?

A routine IT check typically verifies that systems are running — backups completed, devices connected, tickets handled. An IT security review asks whether your protections are still current and effective. It focuses on identity controls, patching status, email authentication, backup integrity and documentation. A routine check asks if things work; a security review asks if they are defensible.

How long should a pre-tax-year security review take for a typical SME?

For a 10 to 25 seat business with documented systems, a focused security review across the five areas covered here typically takes between 90 minutes and two hours. If it is taking longer than that, the issue is usually insufficient existing documentation — which is exactly why the exercise matters.

Should we do a security review in February or wait until March?

February gives you two full months before 6 April to address any findings. The same gaps discovered in March are compressed into a much tighter window, often clashing with year-end financial pressures. There is no material difference in what the review covers — only in how much time you have to act on what you find.

Can we run a security review in-house, or do we need an external provider?

You can run a security review in-house. The skills required are methodical, not technical — checking account lists, verifying updates, confirming backup records. The issue for most owner-managed SMEs is that the person who understands the systems is also the person keeping the business running. That is precisely why a Security Triage Call exists: to identify what needs attention without requiring your team to shoulder the review on top of everything else.

What next?

February gives you time. Use it.

Walk through these five areas with whoever handles day-to-day IT in your business. Make a list of what checks out and what does not. Address access and recovery issues first, then work through the rest in sequence.

If you want an independent assessment of where your security baseline stands before 6 April, book a Security Triage Call. It is a structured conversation about where you are, what gaps exist and what a proper IT Security Baseline would look like for your business. There is no obligation attached.

For SMEs in Sussex and Kent looking for a managed IT partner that treats security as a standard part of operations — not a bolt-on — it is worth reviewing what a proper operating relationship looks like. Infinite Cloud IT's Managed IT Services are structured around maintaining a security-aligned baseline: identity, devices, patches, backups and access control — with clear ownership and monthly reporting.