Free · 2026 · Printable

IT Security Checklist 2026

40 checkpoints in 8 categories — for businesses that want to know where they stand on IT security.

Based on BSI IT-Grundschutz · GDPR Art. 32 · ISO 27001

Unlock checklist

Your access to the complete checklist

IT Security Checklist 2026

RamzX · Heidelberg · ramzx.de · As of June 2026

Access & Identity

5 Points

Two-factor authentication (2FA) enabled for all admin accounts

Password policy with at least 12 characters, complexity, and rotation

No shared admin account ("admin"/"administrator")

Regular review of active user accounts (quarterly)

Accounts locked after 5 failed attempts

Firewall & Network

5 Points

Current firewall firmware / no EOL devices in use

Rules documented and reviewed regularly (every six months)

Network segmentation: servers, office, IoT, and guests kept separate

Inbound connections reduced to the minimum (no open RDP)

VPN for remote work access with 2FA

Backup & Recovery

5 Points

3-2-1 backup strategy implemented (3 copies, 2 media, 1 offsite)

Encrypted backups (AES-256)

Restore test performed and documented at least once per quarter

RTO and RPO defined in writing

Offsite backup not in the same fire compartment as primary data

Systems & Patch Management

5 Points

Up-to-date, complete inventory of all IT systems

Windows/Linux updates applied within 30 days of release

No end-of-life operating systems (Windows 7/8, CentOS 6/7) in use

Antivirus/EDR active on all Windows systems

Application whitelisting for critical systems

Data encryption & GDPR

5 Points

Full-disk encryption on all laptops (BitLocker / FileVault)

Record of processing activities (RoPA) in place and up to date

Data processing agreements (DPAs) signed with all service providers

Deletion policy for personal data documented

Data breach reporting process defined (72-hour GDPR deadline)

Physical Security

5 Points

Server room / rack locked, access logged

No uncontrolled USB ports in publicly accessible areas

Visitor log for server room access in place

Cable management: no cable mess, clear labeling

UPS (uninterruptible power supply) in place for servers

Staff & Awareness

5 Points

Annual IT security training for all employees

Phishing simulation run at least once a year

Written IT security policy in place and signed

Process for reporting security incidents is known

Clean desk policy defined and enforced

Emergency Planning

5 Points

IT emergency plan documented and tested

Emergency contact list up to date and available offline

Business continuity plan (BCP) in place for critical systems

Escalation path for security incidents defined

Cyber insurance taken out or reviewed

Found gaps? Röntgen shows you exactly where.

68 criteria across 12 areas, evaluated automatically. BSI · GDPR Art. 32 · TISAX. PDF report with prioritized actions — right after the questionnaire.

Start your free Röntgen audit Book a consultation

↑ Fill out the form to unlock the complete checklist