Accounts and MFA
Multi-factor sign-in on email and key systems.
Cybersecurity / SME
SME Cyber Hygiene Check
Most attacks on small businesses succeed because of basics: no multi-factor sign-in, no working backup, unpatched laptops, shared passwords. We check the basics quickly and tell you what to fix first, in plain language.
Overview
SME Cyber Hygiene Check
What it is
A short, practical review of the everyday security controls that stop most attacks on small and medium businesses, with a prioritised list of fixes.
Why organisations need it
Ransomware, account takeover and invoice fraud hit Malaysian SMEs every day, and most incidents exploit the same few gaps. The PDPA's Security Principle also expects practical steps to protect personal data. A hygiene check is the cheapest way to close the gaps before an incident does it for you.
Key features
What the engagement covers
Backups
Whether backups exist, are separate and can be restored.
Patching
Operating systems, browsers and key software.
Devices
Laptops and phones, encryption and screen locks.
Passwords
Shared and reused passwords, and password managers.
Staff habits
Phishing awareness and reporting.
Business value
What the business gets out of it
Affordable
Priced for SMEs.
Quick
Days, not weeks.
Plain language
No jargon.
Biggest risks first
Fix list in order.
A foundation
Ready for insurance or customer questionnaires.
How it works
How the engagement runs
01
Questionnaire
Short online questionnaire.
02
Walkthrough
Call or visit to verify.
03
Review
Checking key settings.
04
Report
Fix list in plain language.
05
Follow-up
Optional help implementing fixes.
Deliverables
What you receive
Hygiene scorecard
Simple rating per area.
Fix list
Prioritised actions.
Backup test result
Can you restore?
Policy templates
Simple acceptable use and password rules.
Follow-up call
Answering questions.
Who it is for
Who this is built for
Industries
Company sizes
Departments
Why Orbix
Why organisations choose Orbix
A governance approach, not a tool sale
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Recommendations you can actually implement
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Consultants who have sat on your side of the table
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Built for the Malaysian operating context
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
HRD Corp expertise where it applies
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Questions
Questions we get asked
We have antivirus. Is that enough?
No. Most attacks succeed through stolen passwords, missing backups or unpatched software, which antivirus does not fix.
How long does it take?
Usually a few days from questionnaire to report.
Do you fix things for us?
The check tells you what to fix. We can help implement fixes as an add-on.
Will this help with cyber insurance?
It covers the basics insurers typically ask about.
Is this a penetration test?
No. It is a practical check of basic controls.
Get started
Fix the basics before attackers find them
Tell us your headcount and main systems. We will confirm the fixed fee.