Security posture check
Most organisations aren't one purchase away from being secure. They're a handful of unglamorous jobs away. This assessment asks about those jobs in the order they actually matter, so you finish with a shortlist rather than a shopping list.
Who this is for
Operations, finance and office leads who are accountable for security but don't work in IT day to day.
Time needed: About 5 minutes
01
Is multi-factor authentication switched on for every user, including senior staff?
Exceptions are usually made for the people attackers target most.
02
Do administrators use separate accounts for admin work?
Day-to-day email and admin rights shouldn't share a login.
03
Are leavers' accounts disabled on their last day?
Not the following week, and not when someone notices the licence.
04
Are laptops and servers patched on a known schedule?
Automatic updates that nobody checks aren't the same as patching.
05
Do you have protection against phishing and impersonation beyond the basics?
Things like link checking, attachment scanning and external-sender warnings.
06
Have you restored something from backup in the last six months?
A backup that has never been restored is a hope, not a plan.
07
Do you know which devices can reach company data?
Including personal phones with work email on them.
08
Have staff had security awareness training in the last year?
Short and regular beats an annual hour nobody remembers.
09
Would people know who to call in the first hour of an incident?
Including out of hours, and if email is the thing that's down.
10
Do you get regular, plain-English reporting on your security from whoever supports you?
Not a dashboard login you never open.
Answer the remaining 10 questions to see your result.
Want a second opinion on your result?
Get an IT health check that reviews your support, security and Microsoft setup, then gives you a short, prioritised list of what's worth doing.