Cybersecurity Baseline Checklist

16 foundational controls every modern African organisation should have in place. Check the boxes below to calculate your real-time risk index and print a gap report.

100% Private · No Data Leaves Browser 16 Key Controls ISO/NIST Aligned

Access & Identity

4 Controls

Individual Staff Logins Every staff member has their own named account — no shared logins or generic admin passwords.

Multi-Factor Authentication (MFA) 2FA/MFA is enforced on all corporate emails, accounting packages, and cloud admin consoles.

Role-Based Permissions Access is granted based on minimum necessity; employees cannot access records outside their job scope.

Immediate Offboarding Revocation Leavers lose access to email, VPNs, portals, and shared folders on or before their final day.

Data & Backups

4 Controls

Automated Offsite Backups Critical database and file backups run automatically and are replicated to a secure offsite location.

Tested Restoration Process Backups have undergone a full test restore within the last 90 days to verify data integrity.

Data Classification & Asset Registry You maintain an updated inventory of where customer, financial, and employee data resides.

Device Storage Encryption Full-disk encryption (BitLocker/FileVault) is active on company laptops carrying sensitive data.

Threat Defense & Network

4 Controls

Managed Endpoint Protection Modern antivirus/EDR software is deployed and actively updated across all work workstations.

Automatic Patch Management Operating systems, routers, and business software install critical security updates promptly.

Segregated Guest Wi-Fi Office Wi-Fi for visitors is physically or logically isolated from internal business systems.

Email Security & Spam Filtering SPF, DKIM, and DMARC DNS records are active with anti-phishing inbound inspection.

People & Governance

4 Controls

Security Awareness Training Staff receive regular simulated phishing drills and guidance on reporting suspicious emails.

Acceptable Use & Device Policy A clear written policy outlines password rules, device handling, and remote work safety.

Incident Response Procedure A nominated team member knows the emergency protocol for isolating infected devices and notifying stakeholders.

Third-Party Vendor Vetting External SaaS software and IT vendors undergo security review prior to integration.

Cybersecurity Baseline Checklist

Access & Identity

Data & Backups

Threat Defense & Network

People & Governance

Need a Comprehensive Security Audit?

Cookie preferences