You don't need to be technical to answer these. Each question is about something your business does or doesn't do today, like requiring two-step sign-in or testing your backups. Answer honestly, see your results right away, and get three next steps you can act on. You don't need to give us an email address to see your results.
'Not sure' is a fine answer. If nobody at your company knows, that tells you something useful too.
Yes earns 2 points, Partly earns 1 and No earns 0, for up to 20 readiness points. 'Not sure' also earns 0, because protection nobody can confirm can't be counted, but it's never marked as 'No.' It gets its own count and its own next steps, and if you mark four or more, your result says so. Your results show which answers earned points and which didn't, so nothing is hidden.
Your result
This reflects your answers, not a test of your systems, and it cannot tell you whether you will be breached.
Your three next steps come from your own answers, in a fixed order that starts with the basics, like multi-factor sign-in and backups. Each step says which answer it came from.
Your answers
How scoring works
Yes earns 2 points, Partly earns 1 and No earns 0, for up to 20 readiness points. 'Not sure' also earns 0, because protection nobody can confirm can't be counted, but it's never marked as 'No.' It gets its own count and its own next steps, and if you mark four or more, your result says so. Your results show which answers earned points and which didn't, so nothing is hidden.
0 to 7 readiness points. Getting started: Several of the basics aren't in place yet. The three steps below are the best place to begin.
8 to 13 readiness points. Some basics in place: You have some of the basics. A few gaps are worth closing first.
14 to 17 readiness points. Solid foundation, a few gaps: Most of the basics you asked about are in place. The steps below close what's left.
18 to 20 readiness points. Strong basics: Your answers describe strong basic habits. This check can't tell how well they work in practice, so keep reviewing them.
4 or more answers marked Not sure: Too many unknowns to place yet. Finding those answers is your first step, and the steps below start there.
If question 3 (multi-factor sign-in) or question 7 (backups) is No or Not sure, your result can't go above Some basics in place.
Your three next steps
Start with answers marked No or Not sure, then Partly. Within each group, use this question order: 3, 7, 5, 10, 4, 6, 9, 8, 1, 2. Skip question 10 when question 7 is No or Not sure. Take the first three steps. Use the Not sure wording for a Not sure answer, and the No / Partly wording otherwise. If fewer than three apply, fill from the All in place steps below, in order.
Your three next steps come from your own answers, in a fixed order that starts with the basics, like multi-factor sign-in and backups. Each step says which answer it came from.
This checkup is a self-reported readiness check. Your result comes only from your own answers, at this moment. It is not a scan of your systems, an audit, a certification, a compliance attestation or a prediction of whether your business will be breached. The questions draw on themes from the NIST Cybersecurity Framework 2.0 and NIST's Small Business Quick-Start Guide; NIST has not reviewed or endorsed this checkup. Your ten answers stay in this browser.
A high result doesn't mean an attack can't happen, and a low one doesn't mean you've been hacked.
{"questions":[{"id":1,"area":"Govern","question":"Has one person been given responsibility for cybersecurity decisions in your business, even if it's not their full-time job?"},{"id":2,"area":"Identify","question":"Do you have an up-to-date list of the computers, phones, accounts and cloud services your business uses?"},{"id":3,"area":"Protect","question":"Does everyone's email, and every other important online account, require a second sign-in step (multi-factor authentication)?"},{"id":4,"area":"Protect","question":"When someone leaves your business or changes roles, is their access to accounts and files removed promptly?"},{"id":5,"area":"Protect","question":"Do your computers and key software install security updates automatically or on a regular schedule?"},{"id":6,"area":"Protect","question":"In the last year, have your employees been shown how to spot fake emails, invoices and payment-change requests?"},{"id":7,"area":"Protect","question":"Is your important business data backed up automatically, with a copy kept separate from your everyday systems?"},{"id":8,"area":"Detect","question":"If one of your computers or email accounts showed signs of an attack, would someone be alerted?"},{"id":9,"area":"Respond","question":"If you suspected a cyberattack tomorrow, would your employees know who to call and who makes decisions?"},{"id":10,"area":"Recover","question":"In the last year, have you confirmed that you can actually restore files or systems from your backups?"}],"steps":[{"id":"q1-np","q":"1","text":"Name one person who owns cybersecurity decisions, even part time, and give them an hour a month for it.","href":"/it-consulting-strategy/"},{"id":"q1-ns","q":"1","text":"Ask your leadership team who would make the call if an account were hacked tonight. If nobody answers quickly, naming that person is your first step.","href":"/it-consulting-strategy/"},{"id":"q2-np","q":"2","text":"Write down every computer, phone, shared account and cloud service you pay for, and who uses each one. A spreadsheet is fine.","href":"/it-consulting-strategy/"},{"id":"q2-ns","q":"2","text":"Ask whoever handles your IT for the current list of devices and accounts. If no list exists, start one.","href":"/it-consulting-strategy/"},{"id":"q3-np","q":"3","text":"Turn on multi-factor sign-in for email first, then for banking, payroll and any administrator accounts.","href":"/email-security/"},{"id":"q3-ns","q":"3","text":"Ask whoever manages your email whether every account requires a second sign-in step, including the owner's and any shared accounts.","href":"/email-security/"},{"id":"q4-np","q":"4","text":"Make a short checklist for when someone leaves or changes roles: turn off their accounts, change any shared passwords, collect their devices.","href":"/managed-it-services/"},{"id":"q4-ns","q":"4","text":"Pick the last person who left and check whether their email and file access is actually turned off.","href":"/managed-it-services/"},{"id":"q5-np","q":"5","text":"Set computers and key software to install security updates automatically, and plan to replace anything that no longer receives updates.","href":"/managed-it-services/"},{"id":"q5-ns","q":"5","text":"Ask whoever manages your computers whether updates are automatic and which machines are out of support.","href":"/managed-it-services/"},{"id":"q6-np","q":"6","text":"Spend 30 minutes with your team on what a fake invoice, password reset or payment-change request looks like, and how to check one by calling a number you already have.","href":"/cybersecurity-services/security-awareness-training/"},{"id":"q6-ns","q":"6","text":"Ask a few employees what they'd do with an urgent payment-change email. Their answers will tell you whether training is needed.","href":"/cybersecurity-services/security-awareness-training/"},{"id":"q7-np","q":"7","text":"Set up automatic backups of your important data, with one copy kept separate from your everyday systems so ransomware has a harder time reaching it.","href":"/data-protection-recovery/"},{"id":"q7-ns","q":"7","text":"Find out what is backed up, how often and where the copy lives. Don't assume a cloud app keeps its own backups; check its terms.","href":"/data-protection-recovery/"},{"id":"q8-np","q":"8","text":"Decide who should be told when a computer or account shows signs of an attack, and make sure that alert reaches a person, including after hours.","href":"/cybersecurity-services/threat-detection-response/"},{"id":"q8-ns","q":"8","text":"Ask your IT provider what happens when their tools spot something suspicious: who sees it, when, and who calls you.","href":"/cybersecurity-services/threat-detection-response/"},{"id":"q9-np","q":"9","text":"Write a one-page plan: who to call, who makes decisions, and how to reach your IT provider, insurer and bank if email is down. Print it.","href":"/cybersecurity-services/incident-response-planning/"},{"id":"q9-ns","q":"9","text":"Ask two employees who they'd call if they clicked a bad link. If the answers differ, write the plan down.","href":"/cybersecurity-services/incident-response-planning/"},{"id":"q10-np","q":"10","text":"Pick one important folder or system and do a test restore. Write down how long it took.","href":"/data-protection-recovery/"},{"id":"q10-ns","q":"10","text":"Ask whoever manages your backups when a restore was last tested and what was restored.","href":"/data-protection-recovery/"},{"id":"fill-1","q":"all","text":"Repeat this checkup in six months, or after a big change like a move or new software.","href":null},{"id":"fill-2","q":"all","text":"Walk through your incident plan with your team once a year.","href":"/cybersecurity-services/incident-response-planning/"},{"id":"fill-3","q":"all","text":"Consider a security risk assessment to check that what you answered Yes to works the way you think it does.","href":"/cybersecurity-services/security-risk-assessment/"}],"bands":[{"name":"Getting started","message":"Several of the basics aren't in place yet. The three steps below are the best place to begin."},{"name":"Some basics in place","message":"You have some of the basics. A few gaps are worth closing first."},{"name":"Solid foundation, a few gaps","message":"Most of the basics you asked about are in place. The steps below close what's left."},{"name":"Strong basics","message":"Your answers describe strong basic habits. This check can't tell how well they work in practice, so keep reviewing them."}],"intro":"You don't need to be technical to answer these. Each question is about something your business does or doesn't do today, like requiring two-step sign-in or testing your backups. Answer honestly, see your results right away, and get three next steps you can act on. You don't need to give us an email address to see your results.","scoring":"Yes earns 2 points, Partly earns 1 and No earns 0, for up to 20 readiness points. 'Not sure' also earns 0, because protection nobody can confirm can't be counted, but it's never marked as 'No.' It gets its own count and its own next steps, and if you mark four or more, your result says so. Your results show which answers earned points and which didn't, so nothing is hidden.","nextLead":"Your three next steps come from your own answers, in a fixed order that starts with the basics, like multi-factor sign-in and backups. Each step says which answer it came from.","disclaimer":"This checkup is a self-reported readiness check. Your result comes only from your own answers, at this moment. It is not a scan of your systems, an audit, a certification, a compliance attestation or a prediction of whether your business will be breached. The questions draw on themes from the NIST Cybersecurity Framework 2.0 and NIST's Small Business Quick-Start Guide; NIST has not reviewed or endorsed this checkup. Your ten answers stay in this browser.","boundary":"This reflects your answers, not a test of your systems, and it cannot tell you whether you will be breached.","ui":{"notSureHint":"'Not sure' is a fine answer. If nobody at your company knows, that tells you something useful too.","initialProgress":"0 of 10 answered","result":"Your result","answersHeading":"Your answers","print":"Print or save as PDF","panelHeading":"Keep a copy, or talk it through.","panelBody":"Your results are already on screen. Print them, save them as a PDF or have them emailed to you. All of this is optional.","previewNotice":"Preview only. Email and follow-up are disabled. Nothing is sent.","email":"Email","firstName":"First name (optional)","privacyPrefix":"How we handle this information:","privacy":"Privacy Policy","send":"Send","scoringHeading":"How scoring works","stepsHeading":"Your three next steps","allInPlace":"All in place","disclaimerHeading":"What this checkup is, and isn't.","riskBoundary":"A high result doesn't mean an attack can't happen, and a low one doesn't mean you've been hacked.","unknownRule":"4 or more answers marked Not sure: Too many unknowns to place yet. Finding those answers is your first step, and the steps below start there.","capRule":"If question 3 (multi-factor sign-in) or question 7 (backups) is No or Not sure, your result can't go above Some basics in place.","stepRules":"Start with answers marked No or Not sure, then Partly. Within each group, use this question order: 3, 7, 5, 10, 4, 6, 9, 8, 1, 2. Skip question 10 when question 7 is No or Not sure. Take the first three steps. Use the Not sure wording for a Not sure answer, and the No / Partly wording otherwise. If fewer than three apply, fill from the All in place steps below, in order.","home":"Home","point":"point","points":"points","progress":"{count} of 10 answered","resultHeading":"Your result: {name}","pointsResult":"{points} of 20 readiness points","unknownSingular":"{count} answer marked Not sure","unknownPlural":"{count} answers marked Not sure","unknownName":"Too many unknowns to place yet","unknownMessage":"You marked 4 or more answers Not sure. Finding those answers is your first step, and the steps below start there.","picked":"Picked because you answered {answer} to question {question}.","capSingle":"Because {core} isn't confirmed, your result can't go above Some basics in place.","capBoth":"Because multi-factor sign-in and backups aren't confirmed, your result can't go above Some basics in place.","coreMfa":"multi-factor sign-in","coreBackups":"backups","readiness":"readiness points.","noPartly":"No / Partly"},"answers":["Yes","Partly","No","Not sure"],"answerDescriptions":["In place","Partly in place","Not in place","Not sure"],"ranges":["0 to 7","8 to 13","14 to 17","18 to 20"]}
