A monthly cybersecurity maintenance routine helps you find weak settings before they become urgent problems. Use this repeatable checklist to review updates, antivirus protection, backups, browsers, passwords, multifactor authentication, account activity, and privacy controls across Windows, macOS, Android, iPhone, and shared household devices.
Overview
Security maintenance is less about performing a dramatic cleanup and more about confirming that everyday protections still work. Devices accumulate applications, browser extensions, accounts, permissions, and stored credentials. Automatic updates may pause, a backup drive may stop connecting, or an account may gain an unfamiliar sign-in without anyone noticing.
A practical monthly cybersecurity checklist should answer five questions:
- Are the operating system, applications, browsers, and security tools supported and up to date?
- Is antivirus or built-in malware protection active, updated, and reporting normally?
- Could important files be recovered if a device were lost, damaged, or encrypted by ransomware?
- Do online accounts still use strong, unique passwords and multifactor authentication where available?
- Are installed apps, browser extensions, permissions, and account sessions still necessary?
Start with the devices and accounts used for sensitive activity: banking, email, work, cloud storage, shopping, and identity services. Then review shared tablets, streaming devices, family computers, and smart-home accounts. Keep a simple record with the date, device or account, task completed, and any follow-up needed.
How to estimate
Estimate the effort before beginning so the checklist remains realistic. Count each device that needs an individual review and group accounts by importance. A useful planning formula is:
Monthly maintenance effort = device reviews + account reviews + backup verification + follow-up time.
For each device, allow time to check updates, security status, storage, applications, browser extensions, and permissions. For each important account, allow time to inspect recent activity, recovery details, password status, multifactor authentication, and active sessions. Add extra time when a device has many users, outdated software, limited storage, or unclear backup arrangements.
The goal is not to produce a precise number. The estimate helps you decide whether to complete everything in one session or divide the work into smaller blocks. For example, review computers during the first week, mobile devices during the second, online accounts during the third, and backups during the fourth. Mark a task as “needs follow-up” rather than skipping it when it cannot be resolved immediately.
Use a simple outcome scale for each check:
- Pass: protection is enabled and the expected control is working.
- Review: the setting is unclear, an update is pending, or the device has not been checked recently.
- Action required: protection is disabled, an account activity is unfamiliar, a backup fails, or software is no longer supported.
Inputs and assumptions
Windows and macOS
Install available operating-system and application updates through the device's normal settings. Restart when required, then confirm that the built-in or chosen antivirus product is enabled, receiving updates, and free of unresolved alerts. Do not run multiple real-time antivirus products at the same time unless the vendors specifically support that configuration. If a scan reports a potentially unwanted program, quarantine item, or false positive, review the result rather than deleting files blindly; see how antivirus scan results work.
Review installed programs and remove software that is no longer needed. Check browser extensions one by one: keep only extensions with a clear purpose, remove unfamiliar items, and review the permissions requested by the rest. Confirm that important files are included in a backup and that at least one backup copy is not permanently exposed to the device. A backup is more useful when you periodically verify that files can actually be restored. For ransomware-specific checks, use the ransomware protection checklist.
Android and iPhone
Update the operating system and apps through the official app store or device settings. Remove apps that are unused or no longer needed, especially those with access to contacts, location, photos, microphones, cameras, messages, or accessibility features. Recheck permissions after major updates or when an app changes purpose.
Review the device's security status, screen lock, biometric settings, lost-device features, and automatic backup configuration. On Android, confirm that apps come from trusted sources and review the device's built-in security and app-scanning status. On iPhone, review installed configuration profiles, app privacy reports or permission menus where available, and devices connected to the main account. Avoid treating a mobile antivirus app as a substitute for safe app installation, operating-system updates, and account protection. Our Android antivirus guide explains which features are worth comparing.
Accounts and browsers
Start with your primary email account because it can often be used to reset other passwords. Review recent sign-ins, logged-in devices, recovery email addresses, recovery phone numbers, forwarding rules, and multifactor authentication methods. Repeat the process for financial, shopping, cloud-storage, work, and social accounts.
Use unique passwords for important accounts and store them in a reputable password manager if that fits your workflow. Remove saved passwords from devices or browsers that other people can access. Sign out old sessions, revoke unused third-party app access, and investigate unfamiliar activity through the account provider's official website or app. Never use a link in a suspicious message to investigate an alert; use the service's known address instead. For a focused review, follow this phishing scam checklist.
Worked examples
One person with a Windows laptop and phone
Begin with the laptop: update the operating system and browser, check antivirus status, review extensions, remove unused software, and confirm that documents are backed up. Then review the phone's updates, apps, permissions, screen lock, and backup. Finish with the primary email, password manager, banking, and cloud-storage accounts. Record any pending restart, failed backup, or unknown sign-in for immediate follow-up.
A household with shared devices
Make a device list covering each person's computer and phone, plus shared tablets, game consoles, smart TVs, and router administration. Assign an owner to every device and review the most important accounts first. On shared devices, check separate user profiles, browser autofill, parental-control settings, and whether guests can access another person's saved information. Change the household Wi-Fi administrator password if it has been shared widely, and confirm that router firmware updates and automatic updates are enabled when supported.
A small home office
Separate personal and work accounts where possible. Confirm that work devices use supported software, screen locks, automatic updates, and approved security tools. Review cloud-sharing links, administrator accounts, remote-access tools, and former users' access. Test recovery of a representative work file rather than assuming a backup is usable. If an infection or suspicious login is discovered, stop treating it as routine maintenance and use an incident response process; the malware incident recovery checklist covers the first account, device, and file-protection steps.
When to recalculate
Repeat the checklist monthly, but do not wait for the next scheduled review after a security alert, lost device, suspected phishing attempt, malware detection, password exposure, or unusual account activity. Recalculate the effort whenever you add a phone, computer, browser, cloud service, smart-home device, or family member.
Review the checklist quarterly and after major operating-system releases because menu names, privacy controls, backup behavior, and support requirements can change. Recheck software support whenever a vendor announces an end-of-support date. Revisit antivirus subscriptions before renewal rather than accepting an automatic charge without comparing the devices covered, features needed, and current protection status; see the antivirus renewal checklist.
To finish this month's audit, choose one date, list every device and priority account, and mark each result as pass, review, or action required. Resolve high-impact issues first: disabled protection, failed backups, unsupported software, exposed passwords, missing multifactor authentication, and unexplained sign-ins. Keep the record for the next review so you can measure what changed instead of starting from zero.
