What does a cyber security review cover for an SME?

Short answer

A practical cyber security review for a small or mid-sized business checks the few controls that prevent or limit most incidents: who has access to what, how fast systems are patched, whether backups can really be restored, how suppliers are managed, how email and payment fraud is stopped, and what happens on the day something goes wrong. It ends with a short list of fixes, each with an owner and a date. It is not a penetration test and it is not a certificate, although it often shows whether you need either.

Why review cyber security now?

Breaches are no longer something that only happens to large firms abroad. On 23 January 2026 the Bank of Mauritius issued a public notice after client data of Rogers Capital Credit was reported to have been "unlawfully obtained and published on the dark web", and asked the public to stay alert to fraud attempts (Bank of Mauritius). Notices like this are a reminder that the data you hold about customers is a target, and that the follow-on risk is usually fraud against those customers.

Globally, the World Economic Forum's Global Cybersecurity Outlook 2026, published on 12 January 2026, found that 73% of respondents had been personally affected, or knew someone who had been, by cyber-enabled fraud during 2025, and that 87% saw AI-related vulnerabilities as the fastest-growing cyber risk. Among large companies, 65% named third-party and supply chain weaknesses as their greatest challenge, up from 54% the year before (World Economic Forum).

Update, 19 May 2026: Verizon's 2026 Data Breach Investigations Report found that exploiting software vulnerabilities (31% of breaches) has overtaken stolen credentials as the top way in for the first time in 19 years, that breaches involving a third party now make up 48% of the total, and that employee use of unapproved "shadow AI" rose from 15% to 45% in a year (Verizon, 19 May 2026). That makes patching and supplier checks even more important in the review below.

What does a cyber security review cover?

Area	What the review checks
Access and identity	Who has accounts, whether leavers are removed, whether admin rights are limited, and whether multi-factor authentication is on for email, finance and remote access.
Patching and exposure	How quickly updates are applied, which systems face the internet, and whether anything is out of support.
Backups and recovery	Whether backups are separate from the main systems, and whether a restore has actually been tested recently.
Email, fraud and payments	Phishing protection, and how bank detail changes and urgent payment requests are verified before money moves.
Suppliers and cloud services	Which suppliers hold your data or connect to your systems, and what you know about their security.
Data protection	What personal data you hold, where it is, who can see it, and how long you keep it.
AI tools in use	Which AI tools staff use, what data goes into them, and whether that matches what the business has decided to allow.
Incident response	Who decides what on the day of an incident, who to call, and how customers and regulators would be told.

The review looks at evidence, not just answers: an access list, a patch report, a restore log, a payment change form. Where evidence does not exist, that is itself a finding.

How is a review different from a penetration test or a certificate?

A penetration test has specialists try to break into specific systems. It is deep but narrow, and it says little about backups, suppliers or payment fraud.
A certificate or standard, such as ISO/IEC 27001, is a formal management system with an external audit. It is valuable when customers or regulators ask for it, but it takes months.
A practical review is broad and quick. It tells you where the real gaps are and whether a test or a certificate is the right next step.

How do you prepare for a review?

List your systems and the main suppliers that hold your data.
Export the user list for email, finance and any system holding customer data.
Find the date of your last tested backup restore.
Write down how a supplier's change of bank details is checked today.
Name the person who would lead if you were attacked tomorrow.

None of this needs specialist tools. If any of it is hard to find, you already know where to start.

What does a good review leave you with?

A short, prioritised fix list. Each item has an owner, a date and a reason. Typical early fixes are turning on multi-factor authentication everywhere it is missing, removing old accounts, testing a restore, and adding a call-back step before any change to supplier bank details. Bigger items, such as replacing out-of-support systems, go onto the roadmap.

Decisions about data, such as which cloud services or AI tools may hold customer information, belong to the business and depend on its own appetite for risk. The review's job is to make those choices visible and deliberate.

Update, 29 July 2026: IBM's 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled, costing an average of $6 million against a global average of $4.99 million, and that more than 20% of organisations reported a breach targeting AI models or applications (IBM, 29 July 2026). The "AI tools in use" row above is now a standard part of a review.

Update, 11 September 2026: from 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act (European Commission, 11 September 2026). If you make or sell software or connected products into the EU, add this duty to your incident plan.

Linkgrow's controls and cyber review follows this structure and pairs it with the business controls around it, such as approvals and segregation of duties. For a first read, try the free gap finder.

Frequently asked questions

How long does a cyber security review take for an SME?

It depends on how many systems, sites and suppliers are involved. Most of the effort goes into gathering evidence, so having user lists, backup logs and supplier details ready shortens it.

Do we need a penetration test as well?

Sometimes. If you run internet-facing systems that hold sensitive data, or a customer requires one, a test of those systems is sensible. The review shows whether that is the right next step.

Is a cyber review the same as ISO 27001 certification?

No. ISO/IEC 27001 is a formal management system with an external audit. A review is a quicker check of key controls that can be a first step towards certification.

Where should a small business start if it cannot do everything?

With the controls that limit the most damage for the least effort: multi-factor authentication on email and finance, removing old accounts, a tested backup restore, and a call-back check before any change to supplier bank details.

Sources

Where are the gaps in your operations?

Find your gaps