1. How is IT/security currently handled at your business?

We have a dedicated managed IT/security providerWe have an in-house IT person or team“Whoever's good with computers” handles it informallyHonestly, nobody specific

2. Have you had a security incident or “close call” in the last 12 months (breach attempt, phishing click, ransomware scare, etc.)?

No, and we're confident in our defensesNo, but we're not totally sure we'd catch itYes, we've had at least one scare

3. Do you have tested backups of your critical business data?

Yes — backed up AND tested recentlyBacked up, but never tested a restoreNot really sure / no formal backup

4. Is multi-factor authentication (MFA) enabled on your business email and critical accounts?

Yes, everywhere it mattersOnly on some accountsNo, or not sure what that is

5. If a key employee's laptop was lost or stolen tomorrow, how confident are you that your data would stay safe?

Very confidentSomewhat confidentNot confident at all

6. Does your team receive regular training on spotting phishing emails and social engineering attempts?

Yes, ongoing/regular trainingIt happened once, a while agoNo formal training at all

7. How consistently are software and security patches applied across your devices?

On a set schedule, tracked and verifiedEventually, but not on a real scheduleNot sure / rarely

8. Is your business Wi-Fi network separated from guest/public access?

Yes, fully segmentedSomewhat — there's a guest network, but not sure how isolated it isNo, it's all one network

9. Do you know which third-party vendors or apps currently have access to your business data?

Yes, we track this activelyWe'd have to checkHonestly, no idea

10. If you suspected a breach right now, would you know exactly who to call and what to do first?

Yes, we have a real incident response planNot really — we'd figure it out as we goNo plan at all

How Secure Is Your Business?