Cybersecurity Readiness Assessment
Answer 12 diagnostic questions to uncover high-impact vulnerabilities in your identity, endpoints, email, and backups. Receive an instant 0–100% readiness score and prioritized CIS-aligned recommendations.
Educational Self-Assessment Notice
Cybersecurity Controls Questionnaire
12 Key DomainsDo you maintain an up-to-date inventory of all company-owned laptops, desktops, and network equipment?
Why it matters: Attackers frequently compromise forgotten, unmanaged devices connected to corporate networks.
Is Multi-Factor Authentication (MFA) strictly enforced for ALL users on business email, cloud portals, and VPNs?
Why it matters: MFA blocks over 98% of automated account takeover attacks. SMS-based MFA is better than nothing, but authenticator apps or security keys are strongly recommended.
Do employees use standard (non-administrator) user accounts for their daily work and browsing?
Why it matters: Running daily tasks as local administrator allows malware and drive-by downloads to install silently without prompting.
Are all workstations equipped with centrally managed endpoint security (EDR or modern Antivirus) with automatic signature updates?
Why it matters: Free consumer antiviruses do not alert central IT when a threat is detected on a remote employee machine.
Are operating systems (Windows / macOS) and browsers updated within 14 days of security patch releases?
Why it matters: Most ransomware exploits vulnerabilities for which vendor patches were released weeks or months earlier.
Are your company domain's SPF, DKIM, and DMARC email records properly configured and enforcing rejection of spoofed messages?
Why it matters: Without DMARC enforcement, scammers can send fraudulent invoices or emails pretending to come directly from your exact @company.com address.
Is your guest Wi-Fi, CCTV/IoT network, and contractor access separated via VLANs from internal corporate computers and servers?
Why it matters: A compromised IoT camera or visitor laptop should never be able to discover or sniff internal office computers.
Do you have automated off-site/cloud backups of critical data, and have you successfully tested a file restore in the last 6 months?
Why it matters: An untested backup is not a backup. Ransomware specifically seeks out local network backup shares to encrypt them first.
Are security event logs (such as repeated failed logins or mailbox forwarding rules) captured and monitored for unusual activity?
Why it matters: Attackers often establish hidden mailbox forwarding rules immediately upon compromising an email account.
Does your company have a documented point-of-contact and basic step-by-step checklist in the event of a suspected ransomware or email compromise?
Why it matters: Panicking during an active attack leads to catastrophic mistakes like paying scams or destroying forensic logs.
Are new hires trained on recognizing phishing emails, suspicious payment requests, and safe internet browsing habits?
Why it matters: Human error accounts for over 70% of initial network breaches.
Do you have an explicit guideline instructing employees never to paste proprietary client data, passwords, or customer PII into public AI tools?
Why it matters: Free tier generative AI systems may use inputted text for model training, creating unintended confidential data disclosure.
Domain Score Breakdown
Need a Formal Verification?
Our authorized configuration review checks your active Microsoft 365, Google Workspace, DNS, and network firewall settings against CIS Controls to produce a verifiable remediation roadmap.
Book a Guided Security Review