A 15-minute, plain-English self-assessment for small businesses — with a printable PDF report mapped to Cyber Essentials.
Reflects NCSC 10 Steps / UK SMB cyber risk baseline · Reviewed 2026-06-08
What you'll walk away with. A scored report, top gaps to fix first, and an optional emailed summary.
Was this useful?
Self-assessment
Twenty plain-English questions across the seven things small businesses most often get caught out on. Your answers stay in your browser unless you email yourself the report or save to your account.
Identity & access
Q1 / 19
Is multi-factor authentication (MFA) on for every email, finance and admin account?
Identity & access
Q3 / 19
When someone leaves the business, is their access revoked within 24 hours?
Identity & access
Q4 / 19
Does the team use a password manager (or browser-built-in equivalent) instead of writing passwords in notes / spreadsheets?
Devices & updates
Q5 / 19
Do every laptop, phone and server install security updates within 14 days of release?
Devices & updates
Q6 / 19
Have you removed (or isolated) any operating system or app that the vendor no longer supports (e.g. Windows 10 home machines after Oct 2025)?
Devices & updates
Q7 / 19
Do all company devices run anti-malware (built-in or third-party) with central reporting?
Devices & updates
Q8 / 19
Are all laptops, phones and removable drives encrypted (BitLocker / FileVault / device passcode)?
Data & backups
Q9 / 19
Are critical files backed up automatically, off the same network, and tested at least quarterly?
Data & backups
Q10 / 19
Do you know what personal data you hold and where it sits (CRM, mailbox, spreadsheets)?
People & phishing
Q11 / 19
Has every employee received plain-English training on phishing and password hygiene in the last 12 months?
People & phishing
Q12 / 19
Do you run occasional phishing simulations or know your team's click rate?
People & phishing
Q13 / 19
Does every team member know where to report a suspicious email or text?
Network & boundary
Q14 / 19
Is there a firewall (or hardened router) between every internet connection and your office / home-working devices?
Network & boundary
Q15 / 19
Is your office Wi-Fi separated from a guest Wi-Fi (and is the staff Wi-Fi password rotated when people leave)?
Vendors & supply chain
Q16 / 19
Do you keep a current list of every SaaS / IT supplier that holds your or your customers' data?
Vendors & supply chain
Q17 / 19
Do critical suppliers (accountants, MSPs, payroll) require MFA when accessing your data?
Incident response
Q18 / 19
If your email got compromised tomorrow, would you know who to call and in what order in the first hour?
Incident response
Q19 / 19
Do you carry cyber insurance — and have you read the security clauses in the policy?
Next up: jump to the first unanswered question.
