A digital security checklist converts the abstract goal of “being secure online” into a concrete, verifiable list of specific actions and configurations. Rather than hoping your security posture is adequate, you confirm it — item by item, layer by layer. If you want the full context, see our Complete Guide to Online Security and Privacy.
Security configurations drift over time. Settings get reset by updates. New accounts accumulate without 2FA. Old software goes unpatched. Breach databases grow. A checklist reviewed on a schedule catches these drifts before they become exploitable gaps. The first pass will likely reveal several items that need immediate attention; subsequent passes confirm the configuration remains solid.
One-time setup items — the baseline configuration
These are configured once. An annual confirmation check is worthwhile to ensure settings haven’t been changed by software updates or new device setup.
Accounts and credentials:
- ✓ Password manager installed, vault populated, browser extension active
- ✓ Every account has a unique generated password — no reuse
- ✓ Two-factor authentication enabled on email (authenticator app, not SMS)
- ✓ Two-factor authentication enabled on banking and financial accounts
- ✓ Two-factor authentication enabled on password manager account
- ✓ Backup codes saved in password manager for all 2FA-enabled accounts
- ✓ Security questions use random nonsense answers stored in vault
- ✓ Recovery options (recovery email, phone) secured and verified
- ✓ Credit freeze placed at all three bureaus (Equifax, Experian, TransUnion)
Device security:
- ✓ Full-disk encryption enabled (BitLocker on Windows Pro, FileVault on Mac, default on iPhone, verified on Android)
- ✓ Screen lock with 6-digit PIN or stronger, locks within 2–5 minutes of inactivity
- ✓ Automatic OS updates enabled on all devices
- ✓ Automatic app updates enabled
- ✓ Find My Device / Find My iPhone enabled
- ✓ BIOS/UEFI supervisor password set on laptop
- ✓ Secure Boot enabled on Windows laptop
- ✓ Firewall active on all computers
- ✓ Guest network created on router for IoT/smart home devices
- ✓ Router default admin password changed; WPS disabled; firmware updated
Browser and network:
- ✓ uBlock Origin installed and active in primary browser
- ✓ Browser built-in password manager disabled (using dedicated manager instead)
- ✓ DNS over HTTPS enabled in browser or router
- ✓ VPN installed and configured for use on public WiFi
- ✓ WiFi protected with WPA3 or WPA2-AES and a strong unique password
Quick reference by category and frequency
| Category | Checklist item | Frequency | Where to check |
| Passwords | Vault health report — no weak/reused/breached passwords | Monthly | Bitwarden Reports; 1Password Watchtower |
| Breaches | Email addresses checked against breach database | Monthly | haveibeenpwned.com (or set up free email alerts) |
| Financial | Statements reviewed for unfamiliar transactions | Monthly | Bank and card statements; enable push notifications |
| Backups | Most recent backup completed without errors | Monthly | Backup software dashboard; cloud service web interface |
| Active sessions | All account sessions reviewed; unfamiliar ones terminated | Quarterly | myaccount.google.com → Security; account.microsoft.com |
| Connected apps | OAuth apps audited — unused apps revoked | Quarterly | Google / Microsoft / Apple account security pages |
| Data brokers | Opt-out requests submitted / resubmitted | Quarterly | Spokeo, Whitepages, Intelius, BeenVerified opt-out pages |
| Firmware | Router and smart home device firmware updated | Quarterly | Router admin panel; device apps |
| Recovery options | Account recovery contacts and backup codes current | Annually | Per-account security settings |
| Backup restoration test | Confirm backup is actually restorable | Annually | Restore a test file from backup drive and cloud service |
| Credit report | No unfamiliar accounts or enquiries | Annually | annualcreditreport.com (US) or equivalent |
| Software audit | All installed software reviewed; unused apps removed | Annually | Settings → Apps (Windows/Mac); phone app library |
| Emergency access | Password manager emergency access configured; designated person informed | Annually | Bitwarden Emergency Access; 1Password Emergency Kit |
Using this digital security checklist on schedule takes approximately 5–10 minutes monthly, 20 minutes quarterly, and 60 minutes annually — roughly two hours per year of active maintenance that prevents the vast majority of common security incidents.
The monthly checklist — step by step
- Run the password manager health report. Bitwarden: Tools → Reports → Weak passwords, Reused passwords, and Data breach reports. 1Password: Watchtower → review all flagged items. Change any flagged passwords immediately using the generator. This catches newly breached credentials before attackers have used them.
- Check Have I Been Pwned. Navigate to haveibeenpwned.com and enter each email address you use. Note any new breaches since last check. For any newly-breached service where you still have an account, change the password immediately. (Setting up free email alerts means this step becomes passive notification rather than active checking.)
- Review financial statements. Check bank and card statements for any transaction you don’t recognise. Dispute unfamiliar charges immediately through the card issuer. This catches financial fraud that technical controls and breach databases don’t detect before it appears on the statement.
- Confirm backups ran successfully. Open backup software and confirm the most recent backup completed without errors. For cloud services, open the web interface and confirm recent files are present. A backup that failed silently is worse than no backup strategy because it creates false confidence.
Set a recurring calendar event on the first Monday of each month. The monthly checklist runs in 5–10 minutes and covers the items most likely to have changed since last month.
Triggered reviews — specific life events that need an immediate checklist run
Beyond scheduled maintenance, the digital security checklist should be triggered by specific life events that change the security risk landscape:
- Getting a new device: before transferring data, run through the one-time setup items above. Ensure encryption and screen lock are configured before any data migration. A new device that has never been through a security setup review often becomes the weakest link in an otherwise well-configured posture.
- Starting a new job or leaving one: review which accounts use a work email address for recovery — these may need recovery options updated. Remove work email from personal accounts; ensure no personal passwords are stored in employer systems.
- Ending a relationship: change shared passwords and remove the former partner from any shared accounts. Review which accounts they had access to and check for any OAuth connections through shared devices.
- Moving home: a new address seeds new data broker profiles. Submit opt-out requests immediately after moving, before profiles consolidate around the new address.
- Suspected security incident: change the password for the affected account, review active sessions and terminate unfamiliar ones, check for forwarding rules and connected apps that may have been added, then run the full breach check on all email addresses. Our guide on checking if your email was hacked covers the incident response in detail.
- Hearing about a major breach: if a service you use appears in breach news, check the password manager to see whether you have an account there. If yes: change the password immediately without waiting for a notification from the service.
Keeping the checklist current
A checklist written three years ago may reference tools, services, or threats that have changed significantly. Review the list annually to:
- Add new items that address newly relevant threats (passkeys, AI-driven phishing, new device categories)
- Remove items that are no longer relevant (deprecated tools, services you’ve left)
- Update settings paths that change as operating systems evolve
Store the checklist somewhere accessible — a shared note in the password manager’s secure notes section, or a private cloud notes document. The best digital security checklist is the one that’s actually used on schedule and consulted during events that warrant it. Accessibility and simplicity matter as much as comprehensiveness. Our guides on backing up your data and securing your email provide the detail behind the backup verification and email security items on this checklist. For the FTC’s recommended individual cybersecurity practices that align with this checklist, the FTC’s online security guidance covers the baseline controls and provides incident-specific response guidance.
The checklist for small teams and households
The same framework scales with modest additions for small businesses and households where security is partially collective.
Household additions:
- Each family member’s accounts reviewed for password reuse and missing 2FA (especially children’s gaming and school accounts)
- Shared accounts reviewed — who currently has access and does that still match the intended people?
- Smart home devices confirmed on guest network
- Password manager emergency access configured — trusted person knows how to use it if needed
Small team / small business additions:
- Which cloud services have company data — and what is the data residency and security posture of each?
- Which former employees still have active access to company systems? (Offboarding is one of the most commonly overlooked access control failures in small businesses.)
- Are all company devices running current OS versions with active endpoint protection?
- Have any new services been added to the workflow without a security review?
- Is there a documented incident response plan for the most likely incidents — ransomware, phishing-based credential theft, physical device loss?
Emergency access — the planning item most people defer
Password manager emergency access deserves a specific item on any comprehensive digital security checklist. If the person who holds the master password is unavailable — through accident, illness, or death — trusted family members or colleagues may need access to critical accounts.
Bitwarden Premium and 1Password both offer emergency access features that allow a designated person to request vault access after a configurable waiting period (typically 24–72 hours, allowing the primary holder to cancel accidental requests). Adding this to the annual checklist ensures that:
- Emergency access is set up for at least one trusted person
- The designated person knows how to request access and what to expect
- The waiting period is appropriate for the relationship and risk tolerance
- An emergency kit (printed backup of critical credentials) is physically stored somewhere trusted people know about
This is the long-term planning item that most users defer indefinitely but that matters enormously when it’s actually needed. It’s the final item on the annual digital security checklist for good reason — it represents the difference between a security setup that protects you while you’re actively managing it and one that continues to protect people who depend on your accounts when you’re not.
Security is a state you maintain, not a state you reach. The checklist is the mechanism that converts intention into verification — and verification is what separates a security posture that’s assumed to be adequate from one that’s confirmed to be. You might also run into Cloud Security Best Practices.
Printable quick-reference: monthly and quarterly tasks at a glance
For users who want a simplified version to print and keep accessible:
| Monthly (10 minutes) | Quarterly (20 minutes) | Annually (60 minutes) |
| Run password manager health report; update flagged passwords | Review active sessions on email and financial accounts | Confirm recovery options are current on all important accounts |
| Check email addresses at haveibeenpwned.com | Audit OAuth connected apps; revoke unused | Test backup restoration with a sample of files |
| Review bank and card statements | Resubmit data broker opt-out requests | Review and update credit report |
| Confirm backup ran successfully | Check router and smart home device firmware | Audit installed software; remove unused |
| — | Review app permissions on mobile devices | Verify emergency access setup; update emergency kit |
| — | — | Run through one-time setup items to confirm nothing has drifted |
This three-column table covers the essential cadence without overlap or omission. Monthly items catch things that change frequently — new breaches, accumulating transactions, backup status. Quarterly items catch things that drift more slowly — session accumulation, connected apps, router firmware. Annual items confirm the foundation and address the infrequent-but-important items that are easy to defer indefinitely. Related: Software Supply Chain Security.
The total time investment: roughly 2 hours per year. Against this minimal ongoing time cost, the digital security checklist provides a verified, confirmed security posture that addresses every major risk category for individual and household digital security. Confidence in security is more valuable when it’s based on evidence — and working through this checklist regularly is how that evidence is gathered. If this sounds familiar, Secure Password Reset is worth a look.
