Self-assessment

Cyber-readiness self-check

Eighteen plain questions about the basic controls most organisations should have. You get a score for each area and the five things to fix first. It takes about three minutes.

Accounts and access

Is multi-factor sign-in (a code or app prompt as well as the password) switched on for email and cloud apps?

Stolen passwords are the most common way in. A second factor stops most of them.

Do administrators use a separate account for admin work, and does everyone else work without admin rights?

Malware run by an admin account can change anything on the machine.

When someone leaves, are their accounts, email and access removed the same day?

Old accounts are rarely watched and are easy to misuse.

Do staff use a password manager or unique long passwords, with no shared logins?

Reused and shared passwords turn one leak into many break-ins.

Devices and updates

Are operating systems and key applications updated within about 30 days of a security fix (faster for urgent ones)?

Most attacks use flaws for which a fix already exists.

Is managed endpoint protection (antivirus or EDR) running on every computer and server, and checked centrally?

Unmanaged or switched-off antivirus gives no warning when it matters.

Do you keep a current list of computers, servers, network devices and cameras, and who owns them?

You cannot patch or protect what you do not know you have.

Are laptops and phones that hold business data encrypted, with a screen lock?

A lost or stolen laptop should not be a data leak.

Network and perimeter

Is there a business firewall with current firmware, and are its rules reviewed at least once a year?

Old firmware and forgotten open rules are a common way in.

Does remote access go through a VPN or secure gateway with multi-factor sign-in, and no desktops open to the internet?

Remote desktop open to the internet is a favourite target.

Are guest Wi-Fi, CCTV and other smart devices kept on separate networks (VLANs) from office computers and servers?

Cameras and guest devices are weakly protected; they should not reach your files.

Have default passwords been changed on routers, cameras, recorders and other devices?

Default logins are published online and tried automatically.

Email and people

Is there email filtering for spam, phishing and dangerous attachments, with SPF, DKIM and DMARC set for your domain?

Most attacks start with an email, and spoofed mail damages your name.

Have staff had short security awareness training in the last year, including how to report a suspicious email?

Trained staff are the cheapest control and the last line of defence.

Do payment or bank-detail changes need a second person and a call-back to a known number?

Business email fraud depends on a single person acting on one email.

Backup and recovery

Are important systems and data backed up automatically, with at least one copy kept offline or unchangeable?

Ransomware encrypts backups it can reach.

Has a restore from backup been tested in the last 6 months?

A backup that was never restored is a hope, not a plan.

Monitoring and response

Are logs from the firewall, servers and email kept and looked at, with alerts for odd sign-ins?

Without logs you may not know you were breached, or how.

Is there a written plan for a security incident, with names, phone numbers and who decides what?

In an incident, the first hour is wasted without a plan.

Your result

Answer the questions to see your score. It takes about three minutes, and nothing is sent anywhere.

A self-assessment of basic controls, not an audit, certification or statement of compliance with any law or standard. A real review looks at your systems, not just your answers.

About the check

What it covers and what it does not

Six areas

  • Accounts and access
  • Devices and updates
  • Network and perimeter
  • Email and people
  • Backup and recovery
  • Monitoring and response

How it scores

Each answer scores full, half or nothing, and questions that block the most common attacks count for more. "Not sure" counts as a gap, because a control you cannot confirm is one you cannot rely on.

A starting point, not an audit

The questions follow widely used baseline practice for small and mid-size organisations. The result is an orientation. It is not an audit, a certification or a statement that you comply with any law or standard, and it cannot see how well a control is really set up.

Private

Your answers stay on your device. They are only sent if you press the button to ask for help.

Want the gaps closed, not just listed?

Send us your result and we will suggest the order to fix things in, and what each step involves.

Book an assessmentCall KINNEXWhatsApp