How exposed is your business to a cyber attack?

This page is a printable checklist, not an online calculator. There is nothing to submit and nothing is recorded: print it or read it on screen, and circle the answer under each question that matches how things work today, not how they are meant to work.

Each of the 15 questions has four answers, listed from the strongest control to the weakest. Each question also carries a weight, from 8 to 12 points, based on how much damage a gap in that area tends to cause. Allow about twenty minutes, and ask whoever handles your IT if you are unsure of an answer; "I am not sure" counts as the weakest answer.

How are your business data and systems backed up, and have you tested a restore?

• Strongest: Automated, a copy is kept offsite, and we test restores on a schedule
• Partial: Automated and offsite, but we have never actually restored from them
• Weak: Manual or occasional backups only
• Weakest: No backups, or I am not sure

Is multi-factor authentication enforced on email and your other key applications?

• Strongest: Enforced for every user, on email and the main business apps
• Partial: Enforced for admins and some staff, not everyone
• Weak: Available but optional, users can skip it
• Weakest: No MFA, or I am not sure

What protects your computers and servers from malware and ransomware?

• Strongest: Managed endpoint detection and response, monitored
• Partial: A paid endpoint protection product on every device, not monitored by anyone
• Weak: Only the antivirus that came with the operating system
• Weakest: Nothing consistent, or I am not sure

How are administrator accounts handled?

• Strongest: Separate admin accounts, MFA enforced, and we review who has admin quarterly
• Partial: Separate admin accounts exist, but nobody reviews the list
• Weak: Day-to-day accounts also carry admin rights
• Weakest: Shared admin logins, or I am not sure who has admin

Is your network and email monitored for threats outside office hours?

• Strongest: Yes, monitoring, and alerts are triaged by someone
• Partial: Business-hours monitoring only
• Weak: Alerts exist but generally go unread
• Weakest: No monitoring, or I am not sure

How do operating systems and third-party software get updated?

• Strongest: Centrally managed, with someone verifying that machines actually applied them
• Partial: Automatic updates are on, but nobody checks compliance
• Weak: Staff update their own machines when prompted
• Weakest: Updates are frequently deferred, or I am not sure

Is your domain protected against someone spoofing your email address?

• Strongest: SPF, DKIM and DMARC are all published, and DMARC is set to quarantine or reject
• Partial: SPF, DKIM and DMARC exist, but DMARC policy is still p=none
• Weak: SPF only, or a partial setup
• Weakest: None of these are set up, or I am not sure

Are you still running any operating systems that have passed, or are about to pass, their end-of-support date?

• Strongest: All systems are on supported versions and we track the dates
• Partial: We know of one or two and they are already scheduled for replacement
• Weak: We have some and no plan yet
• Weakest: We are not sure what versions we are running

If you use Microsoft 365, how are its security settings configured?

• Strongest: Reviewed and hardened deliberately, conditional access, legacy authentication disabled
• Partial: Security defaults are on, but nothing beyond that
• Weak: Left as it came out of the box, or configured once at migration and untouched since
• Weakest: I do not know how it is configured, or we do not use Microsoft 365

When someone leaves, how quickly do their accounts and access actually get removed?

• Strongest: Same day, against a written checklist, and we verify it was done
• Partial: Usually within a few days, informally
• Weak: Email gets disabled, but other apps and remote access often linger
• Weakest: No consistent process, or I am not sure what is still active

Who else can get into your systems remotely, vendors, contractors, remote support tools?

• Strongest: We know exactly who has access, it is time-limited, MFA-protected and reviewed
• Partial: We know roughly who has access, but it is standing and not reviewed
• Weak: Several vendors have permanent remote access we have never audited
• Weakest: I am not sure who can get in remotely

Do employees get security awareness and phishing training?

• Strongest: Ongoing training plus simulated phishing, with follow-up for those who click
• Partial: A single session at onboarding
• Weak: Informal reminders when something happens
• Weakest: No training, or I am not sure

Do you have a plan for a cyber attack or a major outage, and has it been tested?

• Strongest: Documented, with named contacts, and walked through at least once a year
• Partial: A plan exists on paper but has never been rehearsed
• Weak: Only an informal sense of who we would call
• Weakest: No plan, or I am not sure

Are laptops, desktops and phones encrypted, and can you wipe a lost device?

• Strongest: Disk encryption is on everywhere and we can remotely wipe a lost device
• Partial: Encryption on most company devices, no remote wipe capability
• Weak: Personal devices access company data with no controls
• Weakest: No encryption, or I am not sure

How is day-to-day IT handled today?

• Strongest: A managed or co-managed IT provider, with monitoring and maintenance included
• Partial: One internal person, or a part-timer wearing several hats
• Weak: We call someone only when something breaks
• Weakest: Nobody really owns IT, or I am not sure

For each question where you circled the third or fourth answer, write down its weight. Add those weights together. The maximum is 145. The higher your total, the more of what limits a common incident is missing or unverified.

Then sort the list by weight. Fix the 12-point gaps first (backups, multi-factor authentication, endpoint protection): each one on its own can turn a routine incident into weeks of downtime. The 10-point gaps decide how far an intruder gets and how quickly anyone notices. The 9-point gaps are quiet routes in. The 8-point gaps mostly limit damage rather than prevent access.

A second-answer response is not a gap on this sheet, but it is the next thing to tighten once the weaker answers are fixed.

It is a structured self-assessment of the control areas that decide how a common incident plays out. It is useful for deciding where to look first and for showing a management team the gaps in plain terms.

It is not an audit and not a scan. It cannot see your network and it believes what you tell it. A real assessment means looking at the actual Microsoft 365 tenant, devices and configuration.

The control areas follow the Canadian Centre for Cyber Security's Baseline cyber security controls for small and medium organizations, a free public control set for organizations without a security team. The weighting is ours, and it is printed so you can disagree with it.

Question 7 is the one most businesses get wrong without knowing. The email spoofing check reads your domain's published SPF, DKIM and DMARC records and tells you whether DMARC is enforcing. In our August 2026 scan of 481 GTA business domains, 20.6% had an enforcing DMARC policy.

If you are holding a proposal from an IT provider, the managed IT quote checker lists 22 things to look for before you sign. If you want a person to go through your answers with you, the IT health check is booked by phone or email.