Cybersecurity isn't something you set up once and walk away from. Threats evolve, employees come and go, systems change, and the controls that were adequate six months ago may not be adequate today. The most effective CEOs I work with treat security the way they treat financial performance, with regular, structured reviews.
This checklist is designed to give you a simple, repeatable framework for reviewing your organization's security posture every quarter. You don't need to be a technical expert. You need 60 minutes, your IT lead, and the willingness to ask direct questions.
Key insight: A quarterly security review is not an audit. It's a leadership check-in that ensures your security program is keeping pace with your business. The goal is visibility and accountability, not perfection.
The Checklist
Access Management
- ☐ All former employees and contractors have had their access revoked across every system
- ☐ Current employee access has been reviewed against actual job requirements
- ☐ Administrative and privileged accounts are documented and limited to those who need them
- ☐ Multi-factor authentication is enabled on all critical systems
Backup and Recovery
- ☐ Critical data is being backed up on schedule
- ☐ A restore test has been completed within the last 90 days
- ☐ Backups are stored separately from primary systems (offsite or immutable cloud storage)
- ☐ Recovery time and recovery point objectives are documented and achievable
Policies and Procedures
- ☐ Security policies have been reviewed for relevance and updated as needed
- ☐ The incident response plan is current and has been tested within the last six months
- ☐ Acceptable use policies reflect current technology and work patterns (remote work, BYOD, cloud services)
- ☐ Business continuity plans account for cyber incidents, not just natural disasters
Vendor and Third-Party Risk
- ☐ New vendors with access to company data or systems have been security-assessed
- ☐ Existing critical vendors have current security certifications or assessments on file
- ☐ Vendor access is limited to what they need and reviewed regularly
- ☐ Contracts include breach notification requirements and data handling terms
Training and Awareness
- ☐ Security awareness training was delivered this quarter (micro-learning, simulation, or both)
- ☐ Phishing simulation results are trending in the right direction
- ☐ New employees completed security onboarding within their first week
- ☐ Role-specific training has been provided for high-risk functions (finance, HR, executives)
Incident Review
- ☐ All security incidents from the past quarter have been documented and reviewed
- ☐ Root causes have been identified and remediation actions completed or scheduled
- ☐ Near-misses and lessons learned have been shared with relevant teams
- ☐ Incident response performance was measured against your target response times
Budget and Resources
- ☐ Security spend is on track against the annual budget
- ☐ Any new risks identified this quarter have been evaluated for budget implications
- ☐ Insurance coverage is adequate for current risk levels and will be reviewed before renewal
- ☐ Security tool licenses and contracts are current with no gaps in coverage
How to Run the Review
Block 60 minutes on your calendar. Invite your IT lead, and if applicable, your compliance or risk management lead. Walk through each section. Don't try to solve problems during the meeting, use it to identify gaps and assign owners with deadlines.
After the review, produce a one-page summary with three sections: what's working, what needs attention, and action items with owners and due dates. Share it with your leadership team. File it so you can track progress quarter over quarter.
"Security isn't a project with a finish line. It's an ongoing discipline. The companies that stay ahead are the ones that review, adjust, and improve every quarter."
Key Takeaways
- Make it a habit, Schedule your quarterly review at the start of the year and treat it like a board meeting
- Focus on visibility, The goal is to know where you stand, not to achieve perfection in one sitting
- Track progress over time, Use each quarter's results to measure improvement and hold your team accountable
- Keep it practical, 60 minutes, one checklist, one summary page with action items
This checklist is adapted from the CEO security governance frameworks in Cybersecurity for CEOs, which includes expanded checklists, quarterly reporting templates, and board presentation guides.
If you'd like help setting up a quarterly security review process for your organization, connect with me on LinkedIn or reach out through my contact page.
"What gets reviewed gets done. What gets reviewed regularly gets done well."