Technology and AI
Cyber security health check
Fourteen plain-English questions on the basics that stop most attacks, with a risk level and fixes.
Check the controls that stop most attacks on small businesses: sign-in and MFA, updates, backups, email and payment fraud, staff awareness and data. You get a risk level, scores for six areas and the fixes to do first.
You will need
- About 5 minutes
- A general picture of your IT set-up (ask your IT provider if you are not sure)
What it covers
- Sign-in and access – Multi-factor authentication, passwords and who has admin rights.
- Devices and software – Updates, protection and what software can run.
- Backups and recovery – Whether you could recover from ransomware or deleted data.
- Email and payments – Protection against phishing, fake invoices and payment redirection.
- People and response – Staff awareness and knowing what to do when something goes wrong.
- Data and suppliers – Knowing where sensitive data is and how suppliers protect it.
Result levels
- High risk (0–39): Basic protections are missing, so the business is exposed to common attacks such as account takeover, ransomware and invoice fraud. Start with MFA, updates and backups this week.
- Some protection (40–64): Some important controls are in place, but gaps remain that attackers commonly exploit. Close the priority gaps first.
- Good foundations (65–84): The essentials are mostly in place. Make them consistent, tested and managed.
- Strong (85–100): Strong basic cyber hygiene for a small business. Keep testing, and consider an independent review.
This is an indicative self-assessment, not an audit or certification.