Free · 3 minutes
Cyber Check
Ten questions about the basics of your company's information security. You get your result and concrete tips straight away. Your answers are not sent or stored anywhere.
Your cyber score
0 / 22
In good shape
You have the basics covered. Great!
Your company's security foundation is strong. The next step is to make sure nothing surprising is visible from the outside, and to keep the level up even when things get busy.
A foundation, with gaps
A good start, but a few doors are ajar
Many things are in order, but a few gaps can be enough for an attacker. The good news: they are usually fixed quickly and affordably once you know where to start.
Time to act
There are big gaps in your security
Don't worry, you are in good company, and this is the easiest situation to improve from. A few basics reduce the risks significantly. Let's start together.
The quickest ways to improve
- Updates: Turn on automatic updates wherever possible, and name a person who checks once a month that nothing has fallen behind.
- Backups: Back up important data automatically, keep one copy separate (e.g. offline or in a different service) and test restoring at least once a year.
- Multi-factor authentication: Turn on MFA first for email and admin accounts. It stops the vast majority of account takeovers.
- Access rights: Make a list of systems and users, give everyone only the access they need, and add account removal to the checklist for when employment ends.
- Passwords: Introduce a shared company password manager. It makes strong, unique passwords effortless.
- Incident plan: Write a one-page incident guide: who to contact, how devices are isolated and which notifications must be made (e.g. to the data protection authority within 72 hours).
- Staff skills: Arrange short security training at least once a year and practise spotting phishing emails. Most attacks start with an email.
- Device and service list: Put together a simple list of devices, software and cloud services with the people responsible. You can't protect what you don't know about.
- Suppliers: List the suppliers that have access to your data and make sure the contracts include security and data protection terms (e.g. a data processing agreement).
- Data protection: Update your privacy policy and record what personal data you process, why and for how long it is kept.
- AI: Record the AI services in use and agree on ground rules: which data is not entered, who approves new services and how results are checked. The EU AI Act also requires staff AI literacy.