Home Services About Resources Contact Get My Score

Detailed Assessment

Detailed Cyber Security Assessment

Review 40 security controls for a more complete view of your organisation’s cyber resilience. Allow approximately 10–15 minutes.

1. Do you have a firewall protecting your network?

Yes, enterprise-grade and actively managed Yes, a basic firewall is in place Not sure / partially configured No firewall in place

2. Do you use multi-factor authentication (MFA) for critical systems?

Yes, enforced across all critical systems Yes, for some systems Planned but not implemented No MFA in use

3. How often are systems and software patched/updated?

Automatically, on a regular schedule Manually, within a few weeks of release Occasionally, no fixed schedule Rarely or never

4. Do you maintain tested, offsite/cloud backups?

Yes, automated and regularly tested Yes, but rarely tested Backups exist but are inconsistent No backup process

5. Do employees receive security awareness training?

Yes, ongoing training and phishing simulations Yes, a one-time onboarding session Informal, ad hoc guidance only No training provided

6. Do you monitor network traffic for intrusions (IDS/IPS)?

Yes, 24/7 monitoring in place Yes, but only reviewed periodically Basic logging only, no active monitoring No monitoring at all

7. Do you have a documented incident response plan?

Yes, documented and tested regularly Yes, documented but not tested Informal plan, nothing written down No plan in place

8. Do you restrict admin/privileged access on a least-privilege basis?

Yes, strictly enforced and reviewed regularly Mostly, with some exceptions Access is broad / loosely controlled No access restrictions

9. Do you provide a secure VPN or zero-trust remote access solution for remote/hybrid workers?

Yes, a managed VPN/ZTNA solution for all remote access Yes, a basic VPN is in place Remote access exists but isn’t secured consistently No secure remote access solution

10. Is sensitive data encrypted both at rest and in transit?

Yes, encryption is enforced everywhere it matters Yes, for most critical systems Only in some places Not encrypted

11. Is your network segmented (e.g. VLANs) to isolate critical systems from general traffic?

Yes, fully segmented with strict controls between zones Partially segmented Minimal separation Flat network, no segmentation

12. Do you assess the security practices of third-party vendors before granting them access?

Yes, formal vendor risk assessments for all partners Yes, for major vendors only Informal checks only No vendor security review process

13. Do you run antivirus/EDR (endpoint detection & response) on all company devices?

Yes, modern EDR on every device, centrally managed Yes, basic antivirus on most devices Only on some devices No endpoint protection

14. Do you have a written security / acceptable use policy for employees?

Yes, documented, distributed, and reviewed annually Yes, but rarely updated Informal guidance only No policy exists

15. Do you use a password manager and enforce strong password requirements?

Yes, enforced company-wide with a managed password manager Yes, for some teams or systems Recommended but not enforced No password policy

16. Are accounts for departed employees disabled promptly?

Yes, same-day via an automated offboarding process Yes, usually within a few days Sometimes delayed weeks or more No formal offboarding process

17. Do your internet-facing services have DDoS protection?

Yes, dedicated DDoS mitigation is in place Yes, basic protection via our host/CDN Not sure what protection we have No protection in place

18. Do you use email security controls (SPF/DKIM/DMARC, anti-phishing filtering)?

Yes, fully configured and actively monitored Yes, partially configured Not sure / configured long ago and untouched No email security controls

19. Are IoT and smart devices on your network patched and hardened?

Yes, inventoried, segmented, and kept updated Some devices are managed Devices exist but are largely unmanaged No visibility into IoT devices

20. Do you have a documented data retention and secure disposal policy?

Yes, documented and consistently followed Yes, but loosely followed Informal practices only No policy in place

21. Do you conduct regular vulnerability scans or penetration tests?

Yes, on a scheduled basis (quarterly or more) Yes, roughly once a year Only done once, a while ago Never tested

22. Does your business carry cyber insurance coverage?

Yes, a current policy matched to our actual risk Yes, but we haven’t reviewed coverage recently Not sure what’s covered No cyber insurance

23. Do you monitor for company credentials leaked or sold on the dark web?

Yes, active monitoring with alerts Occasionally check manually Aware of the risk but no monitoring Never considered this

24. Are laptops and mobile devices encrypted (e.g. BitLocker/FileVault)?

Yes, enforced on all company devices Yes, on most devices Only on some devices Devices are not encrypted

25. Do you provide a separate guest Wi-Fi network isolated from your corporate network?

Yes, fully isolated with no access to internal systems Yes, but isolation isn’t fully tested Guest and corporate traffic share the same network No guest network / open access

26. Do you require a security review before adopting new SaaS or cloud apps?

Yes, formal review and approval process for every new tool Yes, for major tools only Informal, ad hoc checks No review process — anyone can adopt new tools

27. Are security logs centralized and monitored (e.g. a SIEM)?

Yes, centralized logging with active alerting Logs are collected but reviewed only occasionally Logs exist but are scattered / rarely reviewed No centralized logging

28. Do you have physical security controls protecting servers and network equipment?

Yes, locked/access-controlled server room or rack Some controls in place Minimal physical controls Equipment is openly accessible

29. Do you regularly test backups by performing full recovery drills?

Yes, scheduled recovery drills on a regular cadence Occasionally tested Tested once, a long time ago Never tested a recovery

30. Is there a clearly designated owner responsible for cybersecurity in your business?

Yes, a named person/role with clear authority and budget Yes, informally assigned to someone No one specific, handled reactively No ownership at all

31. Do you restrict or control the use of USB drives and removable media on company devices?

Yes, restricted/blocked by policy and technical controls Discouraged but not enforced No restrictions, rarely used Freely used with no controls

32. Do you have a patch management process covering third-party apps and browser plugins (not just the OS)?

Yes, automated and covers all third-party software Yes, for major applications only Handled inconsistently Third-party software is rarely updated

33. Do you maintain a current inventory of devices, software, cloud services, and their owners?

Yes, centrally maintained and reviewed automatically Mostly current, with periodic manual reviews Partial or outdated inventory No reliable asset inventory

34. Are cloud platforms and SaaS configurations reviewed for security misconfigurations?

Yes, continuously monitored with formal reviews Reviewed periodically for critical services Reviewed only after a problem or major change No cloud configuration review

35. Are mobile devices and BYOD access managed through an enforced security policy or MDM?

Yes, all devices are enrolled and policy-enforced Company devices are managed; BYOD is restricted Informal requirements with limited enforcement Mobile and BYOD access is unmanaged

36. Are your domain registrar and DNS accounts protected against unauthorized changes?

Yes, MFA, registry lock, restricted access, and change alerts MFA and restricted administrator access are enabled Some controls exist but have not been reviewed No special protection is in place

37. Are API keys, service credentials, and other secrets stored and rotated securely?

Yes, centrally managed, access-controlled, and rotated Managed securely for critical systems Practices vary between teams and systems Secrets are stored in documents, code, or shared messages

38. Do you have a tested business continuity and disaster recovery plan beyond data backups?

Yes, documented and exercised on a regular schedule Documented but tested infrequently Informal recovery arrangements only No continuity or disaster recovery plan

39. Are privacy, breach notification, and regulatory obligations documented and assigned?

Yes, documented, reviewed, and assigned to accountable owners Key obligations are known and assigned Requirements are handled case by case Obligations have not been assessed

40. Does leadership receive regular security metrics and risk reporting?

Yes, clear metrics and risks are reviewed regularly Periodic reporting covers major issues Reporting is informal or only after incidents Leadership receives no security reporting

Please answer every question before submitting.

✓Your result is ready.

Your Cyber Security Score

Important: This is an indicative self-assessment, not a security audit, certification or guarantee. Read the Assessment Disclaimer.

Want help closing the gaps?

Sprint Networks can walk through your results and build a plan that fits your business.

info@sprintnetworks.com www.sprintnetworks.com.au

SprintNetworks

Cybersecurity and network engineering, built as one. Serving businesses across the Pacific region for more than a decade.

Company

Home About Us Resources Contact

Services

Firewall & Endpoint Email Security Network Design Security Assessment

Get In Touch

info@sprintnetworks.com www.sprintnetworks.com.au Free Risk Assessment