September–October IT Security Checklist: What UK SMEs Must Do Before Q4

It is the two months that determine how quietly the rest of your year will run.

September brings your team back from summer. October carries the last major Cyber Essentials transition deadline until the next cycle opens. For owner-managed SMEs across Sussex and Kent, that combination means there is a narrow window to audit what drifted over the holidays, fix what the Danzell changes exposed, and set your Q4 priorities before December closes everything down.

This checklist pulls together the three priorities that matter most in this window. Each item can be completed within a two-week block, and together they cover the most common gaps that appear when you move from summer calm to autumn pressure.

Why September and October Matter Right Now

The Cyber Essentials transition from the Willow question set to Danzell (version 3.3) closes on 26 October 2026. Any organisation that created an active assessment account before 27 April 2026 has until that date to submit under the old criteria. After 26 October, all new assessments use the Danzell standard — which includes three automatic-fail criteria on cloud-based multi-factor authentication, patching windows, and scope definition that many SMEs have not yet encountered.

This deadline creates a practical urgency: businesses that have been planning certification, or those whose certificates are due for renewal soon, need to decide this month whether to rush through Willow or prepare for Danzell. Both options require action before the end of October.

Beyond that deadline, September and October sit between summer's relaxed security posture and Q4's end-of-year pressure. It is the last clear window to run security reviews, patch backlogs, and backup tests before December holiday staffing makes everything harder.

The September–October IT Security Checklist

1. Decide Your Cyber Essentials Path Before 26 October

If you hold or are pursuing Cyber Essentials certification, the October deadline is your starting point — not a background detail.

• If you created an assessment account before 27 April 2026: you have until 26 October to complete under the Willow question set. If your current controls already meet the five core areas (firewall, secure configuration, access control, malware protection, patch management), finishing now saves you from learning Danzell's stricter requirements while still in progress.

• If you do not yet have an active assessment account: you will be assessed under Danzell from the start. That means factoring in the new automatic-fail criteria for MFA on cloud services, 14-day critical patching, and explicit cloud scope inclusion before you invest time in the self-assessment.

• If your certificate expires soon: contact your certification body about timing. If your certificate expires before 27 April 2026, you may be able to renew under Danzell from the start. If it expires after, clarify whether your renewal is treated as a new assessment subject to the current standard.

A Security Triage Call gives you a high-level view of whether your current controls meet the Danzell requirements, so you can make an informed choice about which path to take.

2. Run a Post-Summer Security Audit

Summer holidays create predictable security drift: devices go offline, patch schedules get missed, and staff return to find configurations that have quietly changed. A structured two-week audit catches this before it becomes a problem.

Week 1: Technical controls

• Verify that all workstations, servers and network equipment have received patches released since July. Devices that have missed critical updates in three months are sitting on known vulnerabilities.

• Check that endpoint protection software is active on every device, including any laptops or devices taken away over the summer. Re-enrol any that lost protection.

• Confirm that your firewall rules have not drifted — temporary rules from summer projects or contractor access should be removed if no longer needed.

Week 2: Identity and access

• Disable any leaver accounts that were missed during summer. Former employees with active accounts are the fastest path to a breach.

• Verify that multi-factor authentication is enabled for all remote access and administrative accounts. This is now an automatic-fail criterion under Cyber Essentials v3.3 (Danzell) if missing on cloud services.

• Review shared or generic accounts. Assign each to a named individual and confirm they are still necessary.

• Check that any new temporary staff or contractors created during summer have appropriate access — and that their access will be removed when their contract ends.

3. Test Your Backups Before December

A backup that has never been restored is an unproven expense. December staffing makes restore testing difficult — half your team will be on leave. October is the last clear month to verify your backups work.

• Identify your three most critical systems and run a full restore test from actual backup media. Do not rely on verification logs alone.

• Document the restore time for each system. Compare it against your recovery time objectives. If a restore takes six hours and your objective is two, you have a gap to close.

• Verify that offsite or cloud backup copies are accessible from an independent network path. Ransomware can encrypt connected backups if they share the same credentials and network access.

• Confirm that backup retention schedules match your regulatory requirements. Excess data stored beyond its legal retention window is a compliance liability, not a safety net.

4. Review Your Incident Readiness

An incident response plan that has not been reviewed in 12 months is worse than no plan — it gives a false sense of confidence.

• Confirm you have a written plan covering ransomware, data breach, and service disruption scenarios.

• Verify that key personnel know who to contact internally and externally in an emergency — including your cyber insurance provider's incident response hotline.

• Check that your incident response plan references current staff, not people who have left over the summer.

• Store the plan in a location accessible during an outage, not only on your primary file server.

5. Plan Your Q4 Priorities

While completing the above, take time to note systemic gaps that need strategic attention in the new planning cycle:

• Are certain devices consistently failing patch compliance? Consider replacement or standardisation.

• Is your helpdesk receiving the same tickets repeatedly? This often indicates a need for standardised device builds rather than ad-hoc fixes.

• Are you clear on whether your Cyber Essentials certification status satisfies your clients' and insurers' requirements? Many enterprise supply chains now require it.

What This Checklist Misses — And When to Dig Deeper

This checklist covers the priorities that most SMEs can action themselves within a two-week window. It does not replace a structured assessment of your full IT security baseline.

If you would like a professional, high-level review of where you stand against the Danzell requirements — or want to understand whether your current setup would pass a technical assessment — a Security Triage Call provides a red-amber-green view of your security baseline and whether a deeper Security Baseline Review is appropriate.

Book a Security Triage Call

FAQ

When should UK SMEs start preparing for the Cyber Essentials transition? As soon as the October deadline is known — ideally in September. This gives you a full month to complete assessments under the Willow question set (if you have an active account created before 27 April 2026) or to prepare for Danzell's stricter requirements.

What changes in the Cyber Essentials Danzell standard? The Danzell update (version 3.3), introduced in April 2026, adds three automatic-fail criteria: multi-factor authentication must be enabled on all cloud services, critical security patches must be applied within 14 days, and all internet-connected cloud services must be in scope for assessment.

Can a SME complete Cyber Essentials certification before 26 October 2026? Yes, if you have an active assessment account created before 27 April 2026, you can submit under the legacy Willow criteria until 26 October. From 27 October, all new assessments use the Danzell standard.

How long does a typical Cyber Essentials assessment take? A typical self-assessment takes two to three weeks from start to certificate, assuming no major issues are found. Allow additional time if technical assessment issues require remediation.