# IT Security Audit for Small Businesses

Source: https://dijitulsupport.co.uk/security-audit/
Updated: 2026-10-10

> dijitul support carries out practical IT security audits for UK small businesses. We review Microsoft 365 or Google Workspace, devices, admin rights, backups, firewall, email authentication and your website, then give you a plain-English report with a prioritised fix list and costs. Audits are quoted upfront based on size; fixes are £45 an hour + VAT.

## Common symptoms

- You have inherited IT from a previous provider and do not know what is set up
- An insurer or customer questionnaire is asking questions you cannot answer
- You are preparing for Cyber Essentials and want to know the gaps first
- Staff have left and you are not sure their access was removed
- You have never tested restoring a backup
- You suspect several people share the same admin login

## Key facts

- Covers accounts and MFA, devices, patching, backups, email, firewall, website and leavers
- Uses Microsoft Secure Score and the Cyber Essentials controls as reference points
- Report written in plain English, with each issue rated and costed
- The Cyber Security Breaches Survey 2025/2026 found only 30% of UK businesses carried out a cyber risk assessment
- Audits are quoted upfront; follow-up fixes are £45 an hour + VAT
- Not a penetration test or a formal certification

## What the audit covers

Our security audit is built for businesses with roughly 2 to 50 staff. It is practical rather than theoretical: we look at how your systems are actually configured, not just what a policy says.

- **Microsoft 365 or Google Workspace:** MFA status for every user, number of global admins, Security Defaults or Conditional Access, legacy authentication, external sharing, mailbox forwarding rules, guest accounts, Microsoft Secure Score.
- **Devices:** operating system versions, update status, encryption (BitLocker, FileVault), local admin rights, endpoint protection status, unsupported software.
- **Backups:** what is backed up, where, how often, whether a copy is offline or immutable, and when a restore was last tested.
- **Network:** firewall and router configuration, port forwards, Wi-Fi security, guest separation.
- **Email:** SPF, DKIM and DMARC status for your domains.
- **Website:** CMS and plugin versions, SSL, admin MFA, backups.
- **People and process:** leaver process, shared passwords, password manager use, how incidents are reported.

## What you get

A short written report, not a 90-page scan dump. Each finding has:

- a plain-English description of the issue and why it matters;
- a priority: fix now, fix soon, or plan for;
- an estimate of the time or cost to fix.

We walk you through it on a call. Many businesses find the top five items can be fixed within a few hours, and those few hours remove most of the realistic risk.

The UK Government's Cyber Security Breaches Survey 2025/2026 found only 30% of businesses had carried out a cyber security risk assessment in the past year. An audit like this gives you one, written down, which also helps when you answer insurance or supplier questionnaires.

## How the audit runs

- **Kick-off call:** 20 minutes to understand how your business works, which systems you use and what prompted the audit, such as an insurance renewal or a new contract.
- **Access:** you give us a temporary admin account or read-only access to Microsoft 365 or Google Workspace, and permission to connect to a sample of devices and your router.
- **Review:** we gather settings, logs and reports, and check them against good practice and the Cyber Essentials controls.
- **Report and call:** we send the report and walk you through it.
- **Tidy up:** we remove any temporary access we were given, unless you ask us to start on the fixes.

## What it is not

Our audit is not a penetration test, where specialists actively try to break in, and it is not a certification. It does not replace Cyber Essentials, ISO 27001 or a regulated sector audit. If you need a penetration test for a contract, we can help you scope what to ask for and fix what the testers find. If you are working towards Cyber Essentials, our audit lines up naturally with the five technical controls, and our [Cyber Essentials readiness](https://dijitulsupport.co.uk/cyber-essentials-readiness/) service takes you from findings to fixes.

For a wider review of your IT, not just security, including hardware age, licensing and how well systems fit the way you work, see our [IT audit](https://dijitulsupport.co.uk/it-audit/).

## Common findings

Some issues turn up in almost every small business we review:

- MFA not enforced for one or two users, often the director or an old shared account.
- Four or more global administrators in Microsoft 365, including day-to-day user accounts.
- Ex-employee accounts still active or still licensed.
- Devices on unsupported Windows versions or months behind on updates.
- Backups that exist but have never been test-restored, or only back up to a drive plugged in permanently.
- No DMARC record, so the domain can be spoofed.
- A router admin page reachable from the internet with the default password.

Each is quick to fix once someone spots it.

## Pricing

Audits are quoted upfront, based on the number of users, devices and sites. You know the price before we start. Fixing what we find is charged at £45 an hour + VAT, or included in the 3 monthly hours on our [Complete plan](https://dijitulsupport.co.uk/pricing/) at £99 a month + VAT. There is no obligation to have us do the fixes. [Ask for an audit quote](https://dijitulsupport.co.uk/quote/).

## FAQs

### What does an IT security audit include?

dijitul's audit reviews Microsoft 365 or Google Workspace security, MFA, admin accounts, device patching and encryption, endpoint protection, backups, firewall settings, email authentication, website security and leaver processes. You get a plain-English report with each issue prioritised and costed, and a call to walk through it.

### How much does a security audit cost?

dijitul quotes audits upfront based on the number of users, devices and locations, so you know the cost before work starts. Fixes found during the audit are charged at £45 an hour + VAT, or come out of the monthly hours on the Complete plan at £99 a month + VAT.

### Is a security audit the same as a penetration test?

No. A security audit reviews how your systems are configured against good practice. A penetration test has specialists actively try to break in. Most small businesses get more value from an audit first. If a contract requires a penetration test, dijitul can help you scope it and fix the findings.

### Will the audit help with Cyber Essentials?

Yes. dijitul's audit checks the same areas as the five Cyber Essentials technical controls: firewalls, secure configuration, security updates, user access control and malware protection. It shows where you would fail. We are not a certification body, but we can fix the gaps before you apply.

### Do you need to visit our office?

Usually not. Almost everything can be reviewed remotely through Microsoft 365, device management tools and a remote session. If something genuinely needs to be checked on site, such as an undocumented network cabinet, dijitul tells you upfront and includes it in the quote.

## Pricing and contact

This work is quoted to fit. Request a quote at https://dijitulsupport.co.uk/quote/ or call 01623 650333.