Do employees use their own individual accounts instead of sharing logins?
Is multi-factor authentication (MFA) turned on for business email?
Is MFA required when employees connect to company systems remotely?
When someone leaves the company, are their accounts promptly disabled?
Is access to administrator or powerful accounts limited to people who need it?
Are company computers protected by business-grade security software?
Are computers and important business applications kept up to date with security fixes?
Do you keep track of the computers, servers, and other devices used for business?
Are your firewall and network protections maintained and securely configured?
Do you have a way to identify and address security problems with company devices and software?
Are important business files and systems backed up automatically?
Are backups protected so a cyberattack on your main systems is less likely to affect them too?
Have you tested restoring files or systems from backups in the past year?
Do you know which business systems and files must be restored first after an outage?
Do you have a plan for keeping the business running if important systems go down?
Do employees receive cybersecurity awareness training at least once a year?
Do employees learn how to spot and report suspicious emails or messages?
Do you have a clear way for employees to report a suspected security problem?
Do you have written security rules or policies that employees can access?
Are new employees given basic security guidance as part of onboarding?
Is someone responsible for reviewing security alerts or suspicious activity?
Do you have a written plan for what to do if you suspect a cyberattack?
Do you know who to contact and who makes decisions during a cyber incident?
Does someone periodically review your systems for security weaknesses?
Has a qualified IT or cybersecurity professional reviewed your security in the last two years?
What best describes your organization?
Approximately how many employees do you have?
What is your biggest cybersecurity concern right now?
Do you handle sensitive customer, healthcare, financial, or government data?
