Small-Team Digital Safety Toolkit

What is in the toolkit

Create an owned review of important accounts, recovery arrangements and routine digital-safety actions.

Small teams organising their own digital-safety checks with an authorised administrator.

The coordinated pack contains three original RDE tools, blank working forms and a fictional worked example. Allow 45–60 minutes for a first practice pass; real work may require further discussion.

Use the pack in sequence

1. Identify important services and name an owner for each. Record references, never passwords or recovery codes.
2. Review available account protections and recovery contacts with the service owner.
3. Plan a recovery exercise using a harmless practice file and an approved backup location.
4. Record actions and review dates. Escalate a suspected incident through the organisation’s established route.

Preview the three tools

Service and account review

Use A01, A02 and similar IDs. Check available protections with official service guidance and the authorised administrator.

Fields include: Service ID, purpose and accountable owner; Authorised users and access review date; Passkey or multi-factor option reviewed; Recovery contact checked and secure reference location; Departed user access and update arrangements; Action, owner and due date.

Practice recovery record

Use non-sensitive practice data. Do not delete production files or disconnect systems to perform this exercise.

Fields include: Exercise ID and linked service ID; Practice file and approved backup location; Person authorised to perform the exercise; Recovery steps followed and date; Recovered file opened and contents compared; Failure, corrective action and next test.

Safety action and contact sheet

Keep this record in an approved shared location. Store secrets elsewhere using the approved secure method.

Fields include: Action ID and linked service or exercise; Issue, priority and reason; Action owner, due date and completion evidence; Known official support or internal reporting route; Reviewer and next review date; Completed action and residual issue.

Worked example

A01 is a fictional team’s shared document service. The owner checks the supported sign-in protections and confirms who can recover access. R01 restores a non-sensitive practice file from the approved backup and compares its contents. The file opens but one paragraph is missing, so action T01 asks the owner to review the backup timing and repeat the exercise. The contact sheet stores an internal support route, not credentials.

Check your learning

Are important services owned, recovery exercises evidenced and outstanding actions assigned without exposing secrets?

Before sharing the pack

Keep IDs consistent between tools, separate facts from assumptions and assign open actions. Remove confidential information and credentials before sharing. Save a dated version so a reviewer can follow later changes.

These organising forms do not replace incident response, specialist advice or a security assessment. Follow your organisation’s approved procedures.

Choose your file

Use Word to type into the forms and duplicate pages for additional records. Use PDF for printing or reading. The PDF is not an interactive form. Both versions contain the same five-page toolkit, including the worked example. Version 1.0, 8 October 2026.

Further guidance

NCSC: Small organisations guide to cyber security

Cover image: AI-generated illustrative scene created specifically for this resource.

Download and use the toolkit

Download the complete toolkit (printable PDF)

Download the complete toolkit (editable Word DOCX)

Coordinated toolkit files in the formats shown. Version 1.0, 8 October 2026. Personal and internal organisational adaptation permitted with Jefferson Otonbara Imgbi author credit retained.