How Protected Is Your Business, Really?

1. Does everyone need a code from their phone (multi-factor authentication) to sign in to business email?

Stolen passwords are one of the most common ways attackers get in. A second sign-in step stops most of them.

2. Are admin rights for Microsoft 365 or Google Workspace limited to one or two dedicated accounts?

If an everyday account with admin rights is compromised, an attacker can take over the whole company.

3. When someone leaves, is their access to email, files and apps removed the same day?

Old accounts that stay active are an easy, unnoticed way back into your systems.

4. Is your email protected by business-grade filtering for phishing and dangerous attachments?

Most attacks start with an email. Good filtering stops the majority before anyone can click.

5. Is all company email on a business plan (Microsoft 365 or Google Workspace) rather than personal accounts?

Personal accounts can't be secured, managed or recovered by the business when staff change.

6. Does every computer have business-grade security software that is monitored centrally (not free or home antivirus)?

Modern threats like ransomware slip past basic antivirus. Monitored protection catches and stops them early.

7. Are Windows, Mac and other software updates installed on every computer within a few weeks of release?

Attackers target known security holes, often within days of a fix being published.

8. Are laptops encrypted, so a lost or stolen laptop doesn't expose company data?

An unencrypted laptop left in a car can turn into a reportable privacy breach.

9. Do you have an up-to-date list of every computer and phone that can access company data?

You can't protect or update devices you don't know about.

10. Are your important files, email and accounting data backed up automatically every day?

Microsoft 365 and Google Workspace don't fully back up your data by default. Without backups, deleted or encrypted data may be gone for good.

11. Is at least one backup copy kept off-site or in the cloud, where ransomware can't reach it?

Ransomware looks for backups on your network and encrypts them too.

12. Has anyone actually tested restoring from a backup in the last six months?

Many businesses only discover their backups don't work when they need them.

13. If your main system went down tomorrow, do you know how you'd keep working and how long recovery would take?

Every hour of downtime costs wages, revenue and customer trust.

14. Is your office protected by a business-grade firewall, not just the modem from your internet provider?

Internet provider routers offer basic protection and are rarely monitored or updated.

15. Is guest Wi-Fi kept separate from the network your business computers use?

A visitor's infected phone or laptop shouldn't be able to see your business systems.

16. When staff work from home, do they connect securely (for example through a VPN or secured cloud apps)?

Remote desktop and file shares left open to the internet are a favourite target for ransomware gangs.

17. Have your staff had cybersecurity or phishing training in the last 12 months?

People are the last line of defence. Trained staff spot and report far more scams.

18. Do staff use a password manager instead of reusing or sharing passwords?

One reused password leaked from another website can unlock your business accounts.

19. If you were hit by ransomware or a fake invoice scam today, do you know exactly who to call and what to do?

The first hour of an incident decides how much damage it does.

20. Do you have cyber insurance, and could you show your insurer the security controls it asks about?

Insurers now require controls like MFA and backups — and can refuse claims when they're missing.