Cybersecurity Self-Check for GTA Businesses

Five questions, one per area: access control, data protection, network security, incident response and compliance. Each offers four answers from nothing in place to a mature control.

Question 1 (Access Control): How do you manage user access across your organization? Access control determines who can view or use resources in your computing environment.

Your responses are confidential and will be used only to generate personalized recommendations.

1. 01

   No formal access management

   Users have unrestricted access with minimal oversight.

2. 02

   Basic password policies

   Password requirements enforced but limited role separation.

3. 03

   Role-based access control (RBAC)

   Users assigned permissions based on their organizational roles.

4. 04

   Advanced IAM with MFA

   Comprehensive identity management with multi-factor authentication.

Our security assessment is a short self-check of how well your organization is protected. It asks five questions, one for each of five areas: access control, data protection, network security, incident response and compliance. Each question offers four answers, running from nothing in place to a mature, well-managed control, so you can pick the one that honestly matches how things work today rather than how they are meant to work.

It is built for owners, office managers and IT leads who want a quick, plain-language read on where their business stands before talking to a provider, or who want a starting point for a conversation with their existing IT team. You do not need technical knowledge to answer the questions, and nothing is scanned or installed: the result is based only on the answers you give.

Each area runs from nothing in place to a mature control. Mostly first or second answers point to the basics first, such as access control policies and an incident response plan; mostly third or fourth answers mean the work is fine-tuning and advanced threat detection.

A self-assessment is a starting point, not an audit. If the score raises questions, our team can walk through the findings with you: see our managed security services or contact IT Rapid Support.

Want a reviewer to do this? See our Microsoft 365 security assessment.

Access control asks how user access is managed, from no formal management through basic password policies and role-based access to identity management with multi-factor authentication. Data protection asks how far encryption goes, from none to encryption at rest and in transit with key management. Network security runs from a basic firewall to intrusion detection and a zero trust design. Incident response asks whether there is a plan and whether it has been tested. Compliance asks whether a compliance program exists and how complete it is.

Answer for how things actually work on an ordinary day, not for the policy document nobody has opened since it was written. An honest answer that shows a gap is more useful than a flattering score.

Use your answers as a short list: mostly first or second answers usually mean the basics come first, such as multi-factor authentication on every account, an incident contact list and access policies, while mostly mature answers point to testing and fine-tuning.

If you would like your answers explained, or want help with the first items on the list, our team can go through it with you; call (289) 582-9930 or email the team. Nothing on this page is sent to us.

This security assessment is a questionnaire. It is a good way to find the areas you are unsure about, but it only knows what you tell it. A full IT security assessment looks at the systems themselves: whether multi-factor authentication is actually enforced, which devices are missing patches, whether the domain publishes SPF, DKIM and DMARC, what the firewall and remote access allow, and whether a backup restores in a test.

Our IT security assessment guide explains what a full assessment should cover and how to prepare for one. Outside a managed agreement, that work is billed by the hour and scoped in writing before it starts.

Once a year is a sensible baseline. Take it again sooner after anything that changes the picture: a cyber insurance renewal, a change of IT provider, an office move or new location, a key IT person leaving, or a security incident. Comparing your new answers with the last ones shows whether the gaps you found have actually been closed.