How this works
Each question is one of the basic protections that security guides for small businesses keep coming back to. They are not equal, so they don't count the same:
- 15 points each: multi-factor sign-in and tested backups. These two stop or undo most of the damage.
- 10 points each: automatic updates, watched security software, training, email domain protection, no everyday admin rights, and a written plan.
- 5 points each: a password manager and separate guest Wi-Fi.
"Not sure" counts as no. If you don't know whether something is in place, it usually isn't, or nobody is checking it.
Example: a typical 12-person office
This office has multi-factor sign-in on email, automatic updates and separate guest Wi-Fi, but nobody has tested a backup and there is no security software that anyone watches.
| Input | Value |
|---|---|
| Does everyone sign in to email and cloud apps with a second step (a code or an app)? | Yes |
| Are your files and email backed up somewhere separate, and has a restore been tested in the last 6 months? | No |
| Do computers install Windows or macOS updates automatically? | Yes |
| Does every computer have security software that someone actually watches? | No |
| Has your team had phishing or security training in the last year? | No |
| Is your email domain protected with SPF, DKIM and DMARC? | No |
| Do people work without administrator rights on their computers? | No |
| Does the team use a password manager instead of writing or reusing passwords? | No |
| Is guest Wi-Fi separate from the network your work computers use? | Yes |
| Is there a written plan for who to call and what to do if you're hacked? | No |
| Result | Value |
| Your score | 30 out of 100 |
| Basics in place | 3 of 10 |
| Fix this first | Set up a backup that lives somewhere separate from your computers, then test a restore. A backup you've never restored is a guess. |
Why small businesses are targets
Criminals don't pick businesses by size; they pick them by how easy they are. Automated tools try stolen passwords against thousands of email accounts a day and look for computers that missed their updates. A small office with no second sign-in step and no tested backup is exactly what those tools are looking for.
The most common results are fake invoices sent from a real mailbox, a locked-up file server with a ransom note, or a bank transfer to the wrong account. Each of them is far cheaper to prevent than to clean up.
The two fixes that matter most
Multi-factor sign-in means a stolen password alone is not enough to get into your email. Microsoft 365 and Google Workspace both include it at no extra cost; the work is turning it on for everyone and helping people set up the app.
Tested backups turn a disaster into an inconvenience. Keep at least one copy somewhere a hacker on your network can't reach, and restore a file from it now and then. Many businesses find out on the worst day of the year that their backup stopped working months ago.
What insurers and clients now ask for
Cyber insurance applications and client security questionnaires ask many of the same questions as this score: multi-factor sign-in, backups, security software, training and a response plan. If several of your answers are no, you may pay more for insurance, be refused cover, or lose a contract that requires them. Fixing them before the renewal or the questionnaire is much easier than after.
What to do with your score
Start with the one fix the tool suggests, then work down the list. Most of the basics can be in place within a few weeks. If you'd like help, we can check each item with you, show you what's already set up in your Microsoft 365, and give you a plain-English list of what's left, in a free 30-minute call.