Free Cybersecurity Risk Score

1. Do you have a firewall protecting your network?

Yes, enterprise-grade and actively managed Yes, a basic firewall is in place Not sure / partially configured No firewall in place

2. Do you use multi-factor authentication (MFA) for critical systems?

Yes, enforced across all critical systems Yes, for some systems Planned but not implemented No MFA in use

3. How often are systems and software patched/updated?

Automatically, on a regular schedule Manually, within a few weeks of release Occasionally, no fixed schedule Rarely or never

4. Do you maintain tested, offsite/cloud backups?

Yes, automated and regularly tested Yes, but rarely tested Backups exist but are inconsistent No backup process

5. Do employees receive security awareness training?

Yes, ongoing training and phishing simulations Yes, a one-time onboarding session Informal, ad hoc guidance only No training provided

6. Do you monitor network traffic for intrusions (IDS/IPS)?

Yes, 24/7 monitoring in place Yes, but only reviewed periodically Basic logging only, no active monitoring No monitoring at all

7. Do you have a documented incident response plan?

Yes, documented and tested regularly Yes, documented but not tested Informal plan, nothing written down No plan in place

8. Do you restrict admin/privileged access on a least-privilege basis?

Yes, strictly enforced and reviewed regularly Mostly, with some exceptions Access is broad / loosely controlled No access restrictions

9. Do you provide a secure VPN or zero-trust remote access solution for remote/hybrid workers?

Yes, a managed VPN/ZTNA solution for all remote access Yes, a basic VPN is in place Remote access exists but isn’t secured consistently No secure remote access solution

10. Is sensitive data encrypted both at rest and in transit?

Yes, encryption is enforced everywhere it matters Yes, for most critical systems Only in some places Not encrypted

Cyber Security Risk Score

Your Cyber Security Score

Want help closing the gaps?