The 10-minute security check every owner should run this quarter
You do not need a security degree to know whether your business is reasonably protected. You need ten honest answers. Set a timer for ten minutes, grab whoever manages your technology, and work through the questions below. Each “yes” is a point. Each “no” or “I do not know” is a gap worth closing.
Your fix-first list
Your answers are scored in your browser and are not stored or sent to us. This check is a starting point, not a security audit.
The ten questions
- Multi-factor authentication. Is a second sign-in step required for email, remote access, and any system that holds financial or customer data?
- Password hygiene. Does everyone use a password manager, or are passwords reused, written down, or kept in a shared spreadsheet?
- Backups. Are backups running automatically, and has anyone actually restored a file or server from them in the last six months?
- Updates. Are operating systems, applications, and network equipment patched on a schedule, with someone responsible for confirming it happened?
- Access. Can you name who has administrator rights, and is access removed the same day someone leaves?
- Email protection. Is there filtering in front of your inboxes, and do people know how to report a suspicious message?
- Training. Has every employee, including leadership, completed security awareness training in the past year?
- Devices. Are laptops and phones encrypted, and can you lock or wipe a lost device remotely?
- Monitoring. Would someone notice, and tell you quickly, if an account signed in from somewhere unusual at 3 a.m.?
- Response plan. If you were hit tomorrow, do you know who to call, who makes decisions, and how customers would be told?
Scoring yourself
Eight to ten: You have a solid foundation. Keep testing it and keep documentation current. Five to seven: You are doing some things right, but a determined attacker would find a way in. Pick the two lowest-effort gaps and close them this month. Four or fewer: Treat this as a priority. Start with multi-factor authentication and tested backups, because they reduce the most risk for the least cost.
What to do with the results
Write down every “no” and every “I do not know.” Rank them by two things: how likely the problem is to hurt you, and how long the fix would take. Then assign each gap an owner and a date. The goal is not a perfect score. It is steady, visible progress that you can show your team, your insurer, and your clients.
Repeat the check every quarter. Threats change, people come and go, and new tools get added without anyone thinking about security. A short, regular review catches drift before it becomes an incident.
Not sure where your business stands? Request a technology assessment.