How well protected is your business? Find out in 5 minutes.
18 questions across 5 areas that a good IT partner should already have answered with you. Your score updates as you go, and nothing is sent anywhere unless you choose to.
1Protection
Is your internet connection protected by a business-grade firewall that's kept up to date and reviewed?
Home-grade routers and forgotten firewall rules are one of the most common ways in.Are all your devices and servers patched within 14 days of security updates being released?
14 days is the Cyber Essentials standard. Most attacks use old, well-known flaws.Do all devices run modern endpoint detection and response, rather than just antivirus?
Antivirus looks for known files. Detection and response spots behaviour, which is how ransomware gets caught.Is inbound email filtered for phishing, spoofing and malicious links, with SPF, DKIM and DMARC set up on your domain?
Email is still the number one way in, and an unprotected domain lets criminals send email as you.Are all laptops and mobile devices encrypted, and can you wipe them remotely if they're lost or stolen?
A lost laptop should be an inconvenience, not a data breach.
2Detection and response
Is someone watching your systems for threats out of hours and at weekends?
Attackers favour 2am on a Saturday. Alerts nobody reads are not monitoring.Do you have a written incident response plan that names who does what if you're breached, and has it been rehearsed?
The first hour of an incident decides how bad it gets. Working it out on the day is too late.Are sign-ins, admin actions and cloud activity logged and kept for at least 90 days?
Without logs you can't tell what an attacker touched, or prove to insurers and customers what didn't happen.
3Recovery
Have you restored from backup in a real test in the last 12 months?
A backup that has never been restored is a hope, not a plan.Are your Microsoft 365 emails and files backed up separately from Microsoft?
Microsoft keeps the service running. Getting back deleted or encrypted data is your responsibility.Do you know how long it would take to get back up after a total outage, and has the business agreed that number?
Recovery time and recovery point objectives turn a vague worry into a plan you can budget for.
4People and access
Is every account protected with multi-factor authentication, including email, remote access and admin accounts?
A stolen password is far less useful when it isn't enough on its own.Do your staff get regular phishing simulations and short security training?
Your people are the most targeted layer and, when trained, the best defence.Are admin rights limited to the few people who need them, using separate admin accounts?
Everyday accounts with admin rights turn a single phishing click into a full compromise.When someone leaves, is their access removed everywhere on the day they go?
Orphaned accounts are a favourite way back in, and a common audit finding.
5Governance and compliance
Does your IT provider sit down with you for a strategic review at least once a quarter?
If nobody is planning your technology, you're only ever reacting to it.Do you have a risk register that includes your cyber risks?
Insurers, customers and Cyber Essentials assessors all want to see that you know your own risks.Do you hold a current Cyber Essentials or Cyber Essentials Plus certificate?
Increasingly a condition of contracts and insurance, and the baseline for Defence Cyber Certification.
Want a proper look under the bonnet?
A health check is a start. Book a call and we'll talk through your answers and what we'd prioritise.