Answer 28 quick questions about how your business runs today. In about 5 minutes you'll get an instant security score and a clear picture of where you may be exposed. No jargon, no sales pitch.
Who can get into your systems, and how protected those doorways are.
Multi-factor authentication (MFA) is turned on for email, banking, and all critical accounts.
Staff use a password manager and a unique password for every account.
Accounts and access are promptly removed when someone leaves the company.
Administrator rights are limited to the few people who truly need them.
The laptops, desktops, and phones that touch your business data.
Every computer runs managed, business-grade endpoint protection (EDR), not just consumer antivirus.
Operating systems and apps are updated on a regular, managed schedule.
Laptops and mobile devices have full-disk encryption enabled.
No business-critical systems run unsupported, end-of-life software (e.g. old Windows).
Whether your data survives a ransomware hit, theft, or hardware failure.
Critical data is backed up automatically every day.
At least one backup copy is kept offsite or in the cloud, separate from your main systems.
A backup has been test-restored in the last 12 months to confirm it actually works.
Access to sensitive files is restricted to only the people who need it.
Email is the #1 way attackers get in. How hardened is yours?
Email runs through advanced spam and phishing filtering.
Your domain has SPF, DKIM, and DMARC set up to stop spoofing of your address.
Employees get regular security-awareness training.
You run simulated phishing tests to see how staff respond.
The wall between your business and the open internet.
A business-grade firewall protects your network (not just the ISP's router).
Guest Wi-Fi is separated from the network your business systems run on.
Remote access to company systems requires a VPN or secure equivalent.
Wi-Fi uses strong, modern encryption and a non-default admin password.
How fast you'd notice an attack, and what you'd do about it.
Your systems are monitored 24/7 for threats and failures.
You have a written incident-response plan for a breach or ransomware event.
There's a clear point of contact to call the moment something goes wrong.
Security events and logins are logged and reviewed.
The policies, coverage, and obligations that keep you out of trouble.
You have written IT and security policies that staff know about.
You carry cyber-liability insurance.
You know which regulations apply to you (HIPAA, PCI, CJIS, etc.) and are meeting them.
Third-party vendors with access to your data are vetted for security.