Is multi-factor authentication (MFA / 2-step verification) turned on for email and key business apps?

Best practice: On for everyone, everywhere

Does the team use a password manager (1Password, Bitwarden, etc.)?

Best practice: Yes, business-wide

Are shared accounts (info@, admin@) avoided where possible?

Best practice: No shared accounts

Are regular staff prevented from installing software on their work computers?

Best practice: Yes — admin rights restricted

Do all work computers have antivirus / endpoint protection?

Best practice: Yes, modern EDR (Defender, etc.) on every device

Do work computers and phones get OS / app security updates promptly?

Best practice: Yes, automatic for everyone

Is full-disk encryption (BitLocker / FileVault) on for laptops?

Best practice: Yes, every laptop

Are screen locks with strong passwords / passcodes / biometrics enforced?

Best practice: Yes, automatic after a few minutes

Is your office Wi-Fi secured (WPA2/WPA3, separate guest network)?

Best practice: WPA3 + separate guest network

Are spam and phishing filters on (Microsoft 365 / Google Workspace built-in or a paid filter)?

Best practice: Yes + premium anti-phishing tier on

Do you use modern browsers and keep them updated?

Best practice: Yes, auto-updating Chrome/Edge/Firefox/Safari

Do you block known-malicious websites at the network or DNS level (1.1.1.1 for Families, NextDNS, etc.)?

Best practice: Yes, for all devices on and off network

Are important business files (cloud + local) backed up?

Best practice: Yes, automatic, off-site, tested

When you share files externally (e.g. with clients), are links restricted (expire, password, specific people)?

Best practice: Yes, always restricted

Are paper documents with sensitive info (HR, finance, customer) physically secured and shredded when no longer needed?

Best practice: Yes, locked and shredded

Do you check the security practices of vendors handling your data (basic questions, certifications)?

Best practice: Yes, for every vendor with sensitive data

Do you require a phone-call verification before paying a new bank account or changing supplier payment details?

Best practice: Yes, mandatory written process

Are invoice / payment fraud awareness habits in place for whoever handles money?

Best practice: Yes, trained and use a callback verification habit

Do you have cyber insurance?

Best practice: Yes, includes ransomware and BEC

Is there one person clearly responsible for "cyber" in your business (even if it’s not their full job)?

Best practice: Yes, named and active

Has the team had any cyber awareness training in the last year?

Best practice: Yes, including phishing simulations

Do staff know what to do if they get a suspicious email or click something they shouldn’t have?

Best practice: Yes, clear who to call

For remote work, is access via secure channels (VPN, ZTNA, or modern SaaS with MFA) — not RDP exposed to the internet?

Best practice: Yes — secure channels only

If you got hacked tomorrow, do you have a basic plan: who calls who, what’s your IT/IR contact, who tells customers?

Best practice: Yes, written down

Small Business Cyber Posture

How it works

1

Answer the questions

30 questions, takes about 10 minutes. One at a time, no time pressure.

2

Get your score instantly

A 0–100 score, your tier, and a per-domain breakdown of where you’re strong and where you’re exposed.

3

Email yourself the report

Your results are saved to your account and emailed as a shareable HTML report you can forward to your team. We don’t spam.

What this assessment covers

The questions span these areas — your final score breaks down by domain so you can see exactly where to focus.

Accounts & passwords

Devices

Email & web

Data & backups

Vendors & money

People

Frequently asked

Is this really free?

Yes — fully free. A simple sign-in lets us save your scores and unlock the Academy. No card, no trial, no upsell. One taster assessment per section is open even without an account.

Do I need to create an account?

A simple login is required so we can track your details, save your assessment results, and unlock the Academy. One taster assessment per section is open without registration; the rest are behind a free sign-in.

How accurate is the score?

The score is a directional read, not a formal audit. Each question has been calibrated against real-world incident data, but no online assessment can capture every nuance of your environment. Use it to find your weakest areas — then go deeper there.

How is my data handled?

If you don’t share an email, your responses never leave your browser. If you do, we store the email + score for 90 days so we can deliver the report and the shareable link. Read the privacy policy.

Can I share the report with my team or board?

Yes — you’ll get a private URL with the full report. Share it via email or paste it into a board pack. The link works for 90 days; let us know if you need it longer.

Does Cyentrix sell consulting?

No. We don’t turn assessment results into a sales call. The advice in the report is the advice — actionable, vendor-agnostic, and free.