Security-first IT support for Central Florida businesses
Request a consultationRemote Support
← All insights

Practical checklist or tool

The 30-Minute Small-Office MFA and Recovery Verification Worksheet

Use this short review to verify whether a small office has protected its most important accounts and can recover from a basic access or data-loss event.

Published October 20, 2026 · By GebhardCS Editorial Team · Reviewed by GebhardCS
Cybersecurity verification worksheet with a security key, approval screen, and backup drive on an office desk

How to use this worksheet

Set aside 30 minutes with the owner, office manager, IT provider, or designated technology lead. The objective is not to perform a technical audit. It is to produce a small record of what is confirmed, what is unknown, and what needs follow-up.

Use one row for each major system: email, file storage, accounting, payroll, practice-management software, remote access, banking, customer relationship management, and backup administration. Do not record passwords, recovery codes, private keys, or full financial account numbers in this worksheet.

For each item, mark Confirmed, Partly confirmed, Unknown, or Not applicable. Add an owner and due date for every gap.

Part 1: Account and MFA checks

  • System or service name:
  • Business owner:
  • Technical provider or support contact:
  • Does every active user have an individual account? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are shared administrator or shared employee logins prohibited? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is MFA enabled for all users? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is MFA enabled for administrators and other privileged accounts? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is MFA enabled for remote access, email, file storage, banking, and payroll? Confirmed / Partly confirmed / Unknown / Not applicable
  • What MFA method is used?
  • Is a phishing-resistant method available and being used for high-risk accounts? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are backup authentication methods documented and controlled? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are sign-in alerts or unusual-login notifications enabled? Confirmed / Partly confirmed / Unknown / Not applicable

CISA states that any MFA is better than none, while phishing-resistant MFA offers stronger protection against phishing. CISA lists security keys among the strongest common options and identifies text or email codes as weaker methods. The practical question for a small office is not whether every system can be modernized immediately. It is which accounts would cause the greatest damage if taken over and whether stronger protection can be applied there first.

Part 2: Former-user and access checks

  • Has the office reviewed every active user in the system? Confirmed / Partly confirmed / Unknown / Not applicable
  • Have former employees, contractors, interns, and temporary users been removed or disabled? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are administrator roles limited to people who need them? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are external guests and vendor accounts documented? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are vendor accounts time-limited or reviewed periodically? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is there a process for same-day access removal after termination? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are mailbox forwarding rules and suspicious inbox rules reviewed after an account concern? Confirmed / Partly confirmed / Unknown / Not applicable
  • Can the office identify who approved each privileged account?

Record the date of the last review and attach a non-sensitive export or screenshot if appropriate. The record should show that access was reviewed, not merely that someone believes it is probably correct.

Part 3: Backup and recovery checks

  • Are critical business files identified? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are backups completing successfully? Confirmed / Partly confirmed / Unknown / Not applicable
  • Are backup alerts reviewed by a named person? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is at least one backup protected from ordinary user or administrator compromise? Confirmed / Partly confirmed / Unknown / Not applicable
  • Can the provider explain how ransomware would be prevented from deleting or encrypting all recovery copies? Confirmed / Partly confirmed / Unknown / Not applicable
  • Has the office restored a representative file in the past 90 days? Confirmed / Partly confirmed / Unknown / Not applicable
  • Has the office tested restoration of a critical application or system? Confirmed / Partly confirmed / Unknown / Not applicable
  • Is the expected recovery time documented?
  • Are the people responsible for authorizing restoration identified?
  • Are critical vendors and support contacts stored outside the primary email system?

A successful backup job is not proof that the business can resume operations. Record what was restored, from which date, how long it took, whether permissions were correct, and what failed or required assistance.

Part 4: Incident contact and escalation checks

  • Owner or executive contact:
  • Technology provider:
  • Cyber-insurance or claims contact:
  • Legal or privacy counsel:
  • Bank fraud department:
  • Critical software vendors:
  • Local law enforcement contact:
  • FBI IC3 reporting reference:
  • Alternate communication method if email is unavailable:

Confirm that at least one contact method does not depend on the potentially compromised account. Store the list in a controlled location and provide a printed or offline copy to the people who may need it.

Part 5: Closeout record

  • Most important confirmed strength:
  • Most important unknown:
  • Highest-priority corrective action:
  • Person responsible:
  • Due date:
  • Evidence attached or location recorded:
  • Date of next review:

Interpreting the result

A “Confirmed” answer should be supported by evidence such as a current account list, provider report, configuration record, alert history, or restoration note. “Unknown” is not a failure; it is a useful risk finding. The office should prioritize unknowns involving administrator access, email, financial systems, remote access, backups, and sensitive data.

This worksheet is a practical management tool, not a compliance determination, penetration test, forensic investigation, or guarantee of security. A human reviewer should validate the answers and involve qualified technical or legal professionals when the issue concerns an active compromise, regulated information, or a material financial loss.

Sources