4 checks every SMB should verify this Cybersecurity Awareness Month
October is Cybersecurity Awareness Month. This year CISA's theme is "Securing the Next 250," and its message to businesses is practical: cover the basics, then level up. CISA's list for organizations includes requiring multifactor authentication, updating software, using logging so your team can monitor for signs of attackers, and backing up data.
Most small and mid-sized businesses we talk with already own tools for every item on that list: endpoint protection, a patching tool, a backup product and Microsoft 365 MFA settings. On paper, the boxes are checked.
But a tool you own is not the same as a control that works. A license proves you bought something. It does not prove anyone is watching it, that it finished its job last night, or that it covers every account and device it should. The gaps we often find at SMBs are not missing products. They are the quiet spaces between "we have that" and "we verified that."
Here are four checks you can run, or ask your IT provider to show you, before the month is out.
1. Do alerts reach a real person who acts on them, 24/7?
Security tools are very good at noticing things. They flag a suspicious login, an unusual process, or a device that suddenly starts encrypting files. Then they send an alert. The question is where that alert goes.
Too often it lands in a shared mailbox nobody owns, a dashboard nobody opens on weekends, or the inbox of an employee who left last year. Attackers know that nights, weekends and holidays are when fewer people are watching. CISA's guidance is to log activity "so your team can monitor signs that threat actors may be trying to access your systems." The key word is monitor. Logs and alerts only help when a person reviews them and responds.
How to verify:
- Ask: who receives a critical alert at 2 a.m. on a Saturday, and what are they expected to do within the first hour?
- Check that alert recipients are current people or a staffed team, not a former employee or an unmonitored alias.
- Trigger a safe test alert and time how long it takes for a human to acknowledge it.
2. Do updates and patches actually finish installing?
CISA puts "update software" among its four foundational practices because outdated software can contain flaws attackers exploit. Most businesses have automatic updates turned on and assume that settles it.
Pushing an update is not the same as installing it. Updates fail. Devices sit waiting for a reboot that never happens. Laptops stay off the network for weeks. A report that says "deployed" can hide a machine that has been pending a restart for a month.
How to verify:
- Pull a report of installed patch levels, not just "approved" or "deployed" status, for every workstation and server.
- Look for devices that have not checked in recently or are waiting on a reboot.
- Confirm that firewalls, network devices and common business applications are on a patch schedule too.
- Identify any systems that are past end of support. CISA's guidance for critical infrastructure includes replacing end-of-support devices.
3. Have you test-restored a backup?
CISA's advice is to back up data so that "recovery is faster and less stressful," with a backup plan aligned to your organization's recovery point objective. CISA also recommends being prepared to recover and restore service to critical systems after an incident.
A backup job that reports "success" every night is reassuring. It is not proof. Backups can be incomplete, can miss a new server or a cloud application, or can take far longer to restore than the business can tolerate. The only way to know is to restore something and see.
How to verify:
- Pick a real file, mailbox or server and restore it to a test location. Confirm it opens and is current.
- Time the restore. Compare it with how long the business can actually be down.
- Confirm what is covered: servers, workstations where it matters, and cloud data such as Microsoft 365.
- Make sure at least one copy is protected from the same credentials an attacker would steal.
- Write down the result and repeat on a schedule.
4. Is MFA actually enforced everywhere, with no gaps?
MFA is one of the most effective controls a business can turn on. In a May 2023 Microsoft Research study of Azure Active Directory (now Microsoft Entra ID) accounts, MFA reduced the risk of compromise by 99.22% across the population studied, and by 98.56% in cases where the account's credentials had been leaked.
That protection only applies where MFA is actually required. "We turned on MFA" often means it is enabled for most users, while a few accounts quietly slip through: an exclusion added during a rollout and never removed, a shared mailbox, a service account, legacy sign-in methods, or a VPN and an admin portal that still accept a password alone.
How to verify:
- In Microsoft 365 and Entra, review which users and accounts are excluded from MFA requirements, and why. Remove exclusions that are no longer needed.
- Confirm that the VPN or remote access tool requires MFA for every user.
- Confirm MFA on admin portals: firewalls, backup consoles, domain registrars, RMM and security dashboards.
- Prefer stronger methods. CISA calls phishing-resistant MFA the standard to strive for and recommends number matching where phishing-resistant options are not yet possible.
Verification is the real security control
None of these checks requires buying anything new. They require someone to own the follow-through: watching alerts, confirming patches, testing restores and auditing MFA, and doing it again next month. That ongoing work is what turns a stack of tools into actual protection.
CISA's toolkit encourages business leaders to talk with IT about which best practices are already in place and where to improve. This month is a good time to have that conversation and ask for proof, not just reassurance.
How KW Corp helps
KW Corporation's Mid-Michigan Managed IT team works as part of your team. We help businesses put these checks on a schedule, document the results and close the gaps we find, so the tools you already pay for do the job you bought them for.
Want a second set of eyes on your alerts, patching, backups and MFA? Contact KW Corp for a free quote.
KW Corporation | Technology @ Your Service
307 W. Grand River Ave, Fowlerville, MI 48836 | 517-223-3610 | support@kw-corp.com