A practical cybersecurity gap assessment checklist for SMB leaders who need to find control weaknesses before audits, insurers, customers, or attackers do.