Is multi-factor authentication (MFA / 2-step verification) turned on for email and key business apps?

Best practice: On for everyone, everywhere

Does the team use a password manager (1Password, Bitwarden, etc.)?

Best practice: Yes, business-wide

Are shared accounts (info@, admin@) avoided where possible?

Best practice: No shared accounts

Are regular staff prevented from installing software on their work computers?

Best practice: Yes — admin rights restricted

Do all work computers have antivirus / endpoint protection?

Best practice: Yes, modern EDR (Defender, etc.) on every device

Do work computers and phones get OS / app security updates promptly?

Best practice: Yes, automatic for everyone

Is full-disk encryption (BitLocker / FileVault) on for laptops?

Best practice: Yes, every laptop

Are screen locks with strong passwords / passcodes / biometrics enforced?

Best practice: Yes, automatic after a few minutes

Is your office Wi-Fi secured (WPA2/WPA3, separate guest network)?

Best practice: WPA3 + separate guest network

Are spam and phishing filters on (Microsoft 365 / Google Workspace built-in or a paid filter)?

Best practice: Yes + premium anti-phishing tier on

Do you use modern browsers and keep them updated?

Best practice: Yes, auto-updating Chrome/Edge/Firefox/Safari

Do you block known-malicious websites at the network or DNS level (1.1.1.1 for Families, NextDNS, etc.)?

Best practice: Yes, for all devices on and off network

Are important business files (cloud + local) backed up?

Best practice: Yes, automatic, off-site, tested

When you share files externally (e.g. with clients), are links restricted (expire, password, specific people)?

Best practice: Yes, always restricted

Are paper documents with sensitive info (HR, finance, customer) physically secured and shredded when no longer needed?

Best practice: Yes, locked and shredded

Do you check the security practices of vendors handling your data (basic questions, certifications)?

Best practice: Yes, for every vendor with sensitive data

Do you require a phone-call verification before paying a new bank account or changing supplier payment details?

Best practice: Yes, mandatory written process

Are invoice / payment fraud awareness habits in place for whoever handles money?

Best practice: Yes, trained and use a callback verification habit

Do you have cyber insurance?

Best practice: Yes, includes ransomware and BEC

Is there one person clearly responsible for "cyber" in your business (even if it’s not their full job)?

Best practice: Yes, named and active

Has the team had any cyber awareness training in the last year?

Best practice: Yes, including phishing simulations

Do staff know what to do if they get a suspicious email or click something they shouldn’t have?

Best practice: Yes, clear who to call

For remote work, is access via secure channels (VPN, ZTNA, or modern SaaS with MFA) — not RDP exposed to the internet?

Best practice: Yes — secure channels only

If you got hacked tomorrow, do you have a basic plan: who calls who, what’s your IT/IR contact, who tells customers?

Best practice: Yes, written down

Free self-assessment

Small Business Cyber Posture

A practical 30-question check for SMBs without a dedicated security team. Free, no account, answers stay in your browser.

Free 30 questions About 10 min No sign-in

Start the self-assessment → Prefer we look? Free exposure review

How it works

Answer honestly. Fix the weakest area first.

01Answer

Answer the questions.

30 questions, about 10 minutes, one at a time. Each one is written in plain language and explains what a good answer looks like, so you can score yourself without a security background.

Accounts & passwordsDevicesEmail & webData & backupsVendors & moneyPeople

02Score

Get your score instantly.

A 0–100 score, your tier, and a per-area breakdown showing where you are solid and where you are exposed — with the free, open-source tools that close each gap.

Outputscore · tier · per-area breakdown

Thenmatching free tools for each gap

03Optional

Email yourself the report.

If you want a copy to forward to your team or board, enter an email at the end and we send a shareable report. Skip it and nothing leaves your browser. Either way there is no account, no login and no follow-up sequence.

Without emailanswers never leave your browser

With emailreport link, kept 90 days

Frequently asked

Before you start.

Is this really free?

Yes. No card, no trial, no account. It is one of the free ways to check your security listed on Free tools.

How accurate is the score?

It is a directional read, not an audit. The questions are calibrated against the controls that actually stop common incidents, but no questionnaire can see your environment. Use it to find your weakest area, then go deeper there — or have us look from the outside with a free exposure review.

How is my data handled?

If you do not enter an email, your answers never leave your browser. If you do, we store the email and score for 90 days so we can deliver the report and the shareable link, then delete them. Privacy policy.

Can I share the report with my team or board?

Yes. You get a private URL with the full report; paste it into a board pack or forward it. The link works for 90 days.

What if the score shows real gaps?

The report tells you what to fix first and which free tools help. If you want a practitioner to verify what is actually exposed — or to test it properly — that is what our assessments are for. No pressure either way; the advice in the report stands on its own.

Other free self-assessments

All free tools →

Free

NIS2 Compliance Quick Check

Where you stand against the EU NIS2 Directive — in 4 minutes.

12 questions · 4 min · Start →

Want a second opinion?

Have a practitioner look from the outside.

A self-assessment tells you what you think. A free external exposure review tells you what an attacker can actually see — no agent, no credentials, no commitment.

Get my free exposure review →