Cybersecurity Assessment

Network and Perimeter Security

• Do you have a business-grade firewall, or are you still running the router your internet provider handed you?
• Is that firewall doing more than blocking obvious threats, such as filtering web traffic and inspecting what crosses the boundary?
• Can you account for every device connected to your network right now?
• Has the firewall setup been reviewed since the day it was first installed?

Email and Cloud Application Security

• Do you have email protection beyond a basic spam filter, catching phishing and impersonation attempts?
• If you use Microsoft 365 or Google Workspace, are the security features configured for how you work, or left at their defaults?
• Is multi-factor authentication, a second step beyond the password, turned on for every account?
• Would anyone be alerted if an account started behaving oddly, such as emailing its whole contact list at once?

Endpoint and Device Security

• Is endpoint protection, the security software on each computer and phone, installed and active on every device that touches company data?
• Does that protection catch threats by their behaviour, or only by matching known viruses?
• Are the personal phones and laptops that reach company email or files covered by any security policy?
• Do you know whether a laptop stays protected once it leaves the office network?

User Security Awareness

• Has your team had any security awareness training in the past year?
• Would your staff recognise a convincing phishing email or a fake request to change payment details?
• Is there a clear, known way for someone to report something that looks suspicious?
• Do people know to verify an urgent money or data request before acting on it?

Data Protection and Backup

• Are your important files backed up automatically, or does it depend on someone remembering?
• Has a backup ever been tested by restoring from it, or is it only assumed to work?
• Is at least one backup kept separate from your main network, out of reach of ransomware?
• Do you know roughly how long it would take to get running again after a serious failure?

Access Control and Authentication

• Does each person have their own login, or are passwords shared around?
• Is multi-factor authentication also enforced specifically on remote access and administrator accounts?
• Are former employees’ accounts shut off promptly when they leave?
• Does each person’s access match their role, so they can only reach what they need?