Cybersecurity in a small business: scope and price of an IT audit

In a small business, the first question after an incident is usually the same: who has the administrator password, and did yesterday's backup run? So improving security does not have to start with an expensive system. First you need to know what accounts, devices and data you have, who has access to them and whether you can restore your most important resources.

The review below helps you find the basic gaps. It will not replace an audit tailored to your environment and risk, but it will show where such an audit should look first.

Scope and cost of an IT audit for a small business

The cost of an IT audit depends first on what exactly needs to be checked, and only then on the number of computers. So before you order one, decide whether you need a quick risk assessment, a process analysis, or a technical security audit with a report for a client or insurer.

This is how it works with us (net prices):

Variant	Scope	Price
Free IT review	60 minutes online with an engineer; the three most important risks in backups, network, access and security controls	PLN 0
Operational audit	Processes and automation: where time is lost, what is retyped by hand, a 6-12 month plan; usually 2-5 days	from PLN 3,500, for companies with more than 50 people from PLN 6,000
Audit of an existing Bitdefender installation	Endpoint protection configuration, policies, coverage and alerts	from PLN 500
Infrastructure security audit	The ten areas described below, within a scope agreed before the start	quoted after a conversation about the scope

An operational audit covers processes and does not cover security fundamentals in full. We quote an infrastructure security audit separately, because its cost depends on several variables:

• the number of workstations, servers and locations;
• the number of cloud services and administrative accounts to review;
• whether it includes technical testing, e.g. vulnerability scanning, or a review of configuration and documentation;
• whether the report has to meet the requirements of a client, an insurer or the national cybersecurity system legislation;
• the availability of documentation: an environment without a device list needs an inventory first.

Whoever the provider is, a good audit report contains a prioritised list of findings, evidence for each finding, a remediation plan with an owner and a deadline, and a description of the risk that remains after the changes. You can implement the recommendations yourselves, with your current provider or with us; the audit does not commit you to any further work.

1. Resource inventory

You cannot protect a system nobody remembers exists. Prepare a list of computers, phones, servers, network devices, cloud applications, domains and administrative accounts. For each item, state the owner, purpose, vendor support status and how it is updated.

The result should be a register that you update regularly. A list drawn up once and filed away stops reflecting reality within six months.

2. Accounts and authentication

Each person should use their own account. Shared accounts make it difficult to track who made the change and complicate revoking access after the collaboration ends.

Check whether:

• passwords are unique and stored in the password manager;
• multi-factor authentication protects email, cloud services, VPN and administrative accounts;
• only the people who need administrator rights have them;
• There are securely stored methods to regain access;
• inactive accounts are disabled.

Where possible, choose phishing-resistant methods, such as hardware keys or passkeys. An SMS code is better than no second factor, but it offers weaker protection than those methods.

3. Granting and revoking access

The onboarding procedure should state who approves access and what its scope is. The offboarding procedure covers disabling accounts, revoking sessions, recovering devices and keys, and changing any credentials that were shared. The same applies to an external IT specialist or IT company; we list the access rights to revoke in our article on changing your IT provider.

Regularly compare actual permissions with employees' current duties. A change of role should not lead to old permissions piling up indefinitely.

4. Updates and lifecycle

Operating systems, applications, browsers, network devices and server software require updates. Simply enabling automatic updates is not enough if no one checks for installation errors or devices outside the management mechanism.

Decide:

• who evaluates and implements patches;
• how quickly critical patches are installed;
• when the service window falls;
• how the update result is checked;
• what happens to hardware and software after manufacturer support ends.

5. Device protection

Company computers should have active, up-to-date endpoint protection. Its scope depends on the system, the licence and the risk. Besides malware protection, check disk encryption, screen lock, restriction of local administrator rights and the ability to lock a managed device remotely.

Confirmation that the software was installed at some point is not enough. The administrator should have reliable information about the protection status of all devices and act on those that have stopped reporting.

6. Backup and recovery

A backup is only worth something if you can restore data from it within the required time. The backup scope should follow from agreed RPO and RTO values, that is, the acceptable data loss and the time needed to restore a process.

Check:

• what data and configurations are copied;
• whether copies are separated from accounts and production systems;
• whether incorrect or missing tasks create an alert;
• who views reports;
• when the last documented recovery test was performed.

The 3-2-1 rule is a good starting point, but it does not replace threat analysis, retention or testing. We cover this in more detail in our guide to in-house backups.

7. Email and phishing resistance

A compromised mailbox can lead to payment fraud, data theft and impersonation of the company. Besides MFA, check the SPF, DKIM and DMARC configuration, automatic forwarding rules, accounts with access to mailboxes and unusual sign-ins.

Staff training should cover real scenarios: a change of bank account number, an urgent request from a manager, a fake login page and a suspicious attachment. Confirm important financial changes through an independent channel, using a phone number you already know.

8. Network and remote access

The guest network, IoT devices, staff computers and administrative infrastructure should not form one unrestricted zone by default. Segmentation requires correct firewall rules and isolation testing. We describe the basics in our article on corporate network security.

Provide remote access only to the resources that are needed, protect it with MFA and log it. A VPN can be one part of the solution, but it is not automatically needed for every cloud service and it will not fix a compromised device.

9. Event logging and response

You should know where the first sign of a problem will come from. Logs and alerts need to be kept for long enough, device clocks need to be synchronised and someone has to be responsible for reviewing them.

A short incident response procedure states:

• decision maker;
• contact details of the IT team, suppliers, bank and insurer;
• a way to isolate a suspicious device without destroying evidence;
• system recovery order;
• rules for documenting the event and assessing reporting obligations.

A copy of the procedure should be available even when email and the company's core systems are down.

10. Legal and contractual requirements

GDPR requires measures appropriate to the risk, without imposing one configuration on every company. A personal data breach does not always have to be reported: according to Personal Data Protection Office no notification is required where the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where notification is required, the controller makes it without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. A specific incident should be assessed by a data protection officer or a lawyer.

NIS2 in Poland: the amendment to the National Cybersecurity System Act

The NIS2 Directive is implemented by the Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, published on 2 March 2026 in the Journal of Laws (Dz.U.) as item 252. The new rules came into force on 3 April 2026.

The Act divides the organisations it covers into essential and important entities. As a rule, this means medium and large enterprises in the sectors listed in the annexes to the Act, but some categories are covered regardless of size, e.g. DNS service providers and domain name registration service providers. Managed security service providers are covered from the small enterprise threshold. Status depends on the sector, type of activity, size and detailed criteria, so each company assesses it for itself.

The key deadlines for entities that met the criteria on the date the Act came into force, according to the Ministry of Digital Affairs and the text of the Act:

• by 3 October 2026 an application for entry in the register of essential and important entities, submitted electronically;
• by 3 April 2027 fulfilment of the obligations in Chapter 3 of the Act, including implementation of an information security management system (ISMS);
• by 3 April 2028 the first audit at essential entities.

An entity that meets the criteria later submits its application for entry within 6 months of that date and fulfils the Chapter 3 obligations within 12 months. The amendment also introduces financial penalties, among others for failing to register and for failing to implement a security management system.

Even if your company is not covered by the Act, requirements may come from a client that is itself an essential or important entity and has to manage supply chain risk. We describe in detail what the amendment means for small and medium-sized businesses in our article on the KSC amendment and NIS2.

The information above is general in nature and does not constitute legal advice.

What to do after the audit

Not all gaps have the same impact. Fix first those that combine high likelihood with serious consequences, for example no MFA on an administrative account, no working backup of key data, or a publicly accessible, unsupported service.

For each task, record the owner, the deadline, how completion will be confirmed and the risk that remains after the change. Without a remediation plan, an audit is just a description of the problem. We can help implement the fixes as part of our cybersecurity for businesses, starting by establishing the scope of the environment.

Sources

• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, Journal of Laws (Dz.U.) 2026 item 252, https://api.sejm.gov.pl/eli/acts/DU/2026/252/text.pdf (accessed 02/10/2026)
• Ministry of Digital Affairs, Miesiąc na samorejestrację w Wykazie KSC. Termin mija 3 października (One month to self-register in the KSC register. The deadline is 3 October), 3.09.2026, https://www.gov.pl/web/cyfryzacja/miesiac-na-samorejestracje-w-wykazie-ksc-termin-mija-3-pazdziernika (accessed 02/10/2026)
• Gov.pl, Nowelizacja ustawy o krajowym systemie cyberbezpieczeństwa (Amendment to the National Cybersecurity System Act), 14.04.2026, https://www.gov.pl/web/baza-wiedzy/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa (accessed 02/10/2026)
• Personal Data Protection Office, Zgłaszanie naruszeń (Reporting breaches), https://uodo.gov.pl/pl/525/2584 (accessed 02/10/2026)

As of 2 October 2026.