Quarterly network security checklist

Run this every three months and after any staff change. A printable copy is on the downloads page.

Router

• ☐ Admin password is not the default and is stored in the password manager
• ☐ Remote / WAN administration is off
• ☐ SSH is key-only or disabled
• ☐ Firmware is the latest stable release for this hardware revision
• ☐ WPA2-AES or WPA3; WPS off; UPnP off
• ☐ Every port forward has a written reason
• ☐ Logs are shipped off the device

Wi-Fi

• ☐ Staff passphrase changed after the last departure
• ☐ Guest network isolated from staff and printers
• ☐ No unknown access points broadcasting the office name

Printers

• ☐ On their own segment; cannot start connections to staff devices
• ☐ Ports 9100, 515, 631, 161 not reachable from the internet (tested from outside)
• ☐ Admin panel password set; HTTPS only
• ☐ Telnet, FTP, SNMP v1/v2c disabled or restricted
• ☐ Firmware current

Paperwork

• ☐ Network baseline document updated
• ☐ Firmware update log filled in
• ☐ Configuration backups stored off-site