Cyber basics

Two quick questions about your set-up so we skip what doesn't apply. These aren't scored.

1. Do you use cloud services for email, files or business apps, such as Microsoft 365, Google Workspace, Xero or a cloud CRM?
2. Do you have an office, shop or clubhouse network (a router or Wi-Fi) that you or your IT provider control?

Devices straight out of the box are set up for convenience, not security. This section checks you've tightened them up.

1. Upload a list of the laptops, desktops, phones, tablets and servers used for work, including who uses each one. Evidence needed IT provider
2. Is the built-in firewall switched on for every laptop and desktop? IT provider
3. Have unused software, default accounts and unnecessary features been removed or disabled on your devices? IT provider
4. Do all devices lock automatically after a short time and require a PIN, password or biometric to unlock, with encryption switched on? IT provider

From the help text

You can only secure devices you know about. A simple spreadsheet is fine: device, user, operating system and version.

The right people with the right access, and no more. This is where many real-world attacks are stopped.

1. Does everyone have their own user account, rather than sharing logins? IT provider
2. Are administrator rights limited to the few people who need them, with those people using a normal account for everyday work like email and browsing? IT provider
3. When someone leaves (staff, volunteer or contractor), are their accounts disabled on their last day? Manager or IT provider
4. Do people use long, unique passwords for work accounts, ideally with a password manager? Owner or manager

From the help text

Shared accounts make it impossible to remove one person's access or see who did what. 'Yes' means one account per person on devices and systems.

Email and cloud admin accounts are prime targets. Multi-factor authentication is the single most effective fix.

Asked only if you answer “Yes” to: Do you use cloud services for email, files or business apps, such as Microsoft 365, Google Workspace, Xero or a cloud CRM?

1. Is multi-factor authentication (MFA) switched on for every administrator account on your cloud services? Knock-out IT provider
2. Is MFA switched on for every user's email and cloud accounts, not just admins? IT provider
3. How many people have full (global or super) admin rights on your main cloud service? IT provider

From the help text

A cloud admin account without MFA can be taken over with a single stolen password, putting all your data at risk. This is treated as a must-have.

Stopping malicious software from getting in and running on your devices.

1. Is anti-malware protection (such as Microsoft Defender) active and up to date on every laptop and desktop? IT provider
2. Where do people install software and apps from? Tick all that apply. IT provider
3. Have staff and volunteers been shown how to spot phishing emails and fake invoice requests, and do they know who to tell? Manager

From the help text

Anti-malware catches much of the everyday malicious software that reaches devices. 'Yes' means it's on, updating automatically and ideally centrally monitored.

Attackers move quickly once a weakness is announced. Keeping software supported and updated closes the door.

1. Are any devices running an operating system or software that no longer gets security updates from its maker (for example Windows 10 without extended security updates, or an old version of Office)? Knock-out IT provider
2. Are automatic updates switched on for operating systems, browsers and apps on all devices? IT provider
3. When a critical or high-risk security update is released, how quickly is it usually installed? IT provider

From the help text

Unsupported software never gets fixed, so known weaknesses stay open forever. Schemes like Cyber Essentials treat this as an automatic fail, and so does AuditGlass.

Good backups and a simple plan turn a potential disaster into a bad day.

1. Is important data backed up automatically, with at least one copy kept offline or separate from your main systems? IT provider
2. When did you last test restoring data from a backup? IT provider
3. If you were hit by ransomware or an account takeover tomorrow, do you know who to call and what to do first? Owner or manager

From the help text

Ransomware often targets backups too. The NCSC advises keeping backups in a secure location not directly connected to your network. 'Yes' means an automatic backup with a separate copy.