Security Self-Assessment
Small business security self-assessment.
Answer 15 quick questions to see where your organisation stands against the attacks that hit small and mid-sized businesses most — ransomware, phishing and account takeover. Takes about five minutes.
Start the assessment
Answer honestly — “Not sure” counts as a gap, because an unknown control is an unmanaged one. Your answers stay in your browser.
1. Is multi-factor authentication (MFA) required for email, remote access/VPN and all admin accounts?
2. Does everyone use unique passwords, stored in a password manager?
3. Are everyday user accounts kept separate from admin accounts, with local admin rights removed?
4. Are operating systems and applications patched within 14 days, and critical or actively exploited flaws within 72 hours?
5. Is endpoint protection (EDR or modern antivirus) installed and monitored on every computer and server?
6. Do you keep an up-to-date inventory of devices, software and cloud services?
7. Is your firewall default-deny, with no RDP, SMB, database or device admin interfaces exposed to the internet?
8. Are routers, switches, firewalls and Wi-Fi hardened: default passwords changed, SSH instead of Telnet, firmware up to date?
9. Are guest Wi-Fi and IoT devices (cameras, printers, smart TVs) separated from the business network?
10. Do you keep 3-2-1 backups, including at least one offline or immutable copy that ransomware can't reach?
11. Have you successfully tested restoring critical systems from backup in the last six months?
12. Are SPF, DKIM and DMARC configured for your email domain, with DMARC set to quarantine or reject?
13. Do all staff receive security awareness and phishing training at least once a year?
14. Must payment and bank-detail changes be verified by phone, using a number you already have on file?
15. Do you have a written incident response plan, with contacts, and central logs kept for at least 90 days?
By area
Your priority actions
About the scoring
Each control is weighted by how much it reduces real-world risk: MFA, patching, internet exposure and offline backups count three times as much as an asset inventory. “Yes” scores full points, “Partly” half, and “No” or “Not sure” zero. The questions draw on the CIS Critical Security Controls Implementation Group 1, the NIST Cybersecurity Framework and the UK NCSC Cyber Essentials.
This self-assessment is educational guidance, not a formal audit or certification. For an independent assessment, talk to MAG212 CYBER.
MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.