Why this matters:
Cybersecurity isn’t something you can afford to “kind of” handle anymore. Who you trust with your IT has a huge impact on your overall risk — especially as cyber threats grow more targeted toward small businesses.

What your answer tells us:

• Dedicated in-house team – That’s a strong foundation. Just make sure they have cybersecurity-specific expertise and stay up to date — it changes fast.
• Managed IT service provider (MSP) – Great, especially if your MSP specializes in security. Not all do, though — and some only handle the basics.
• Friend or family member – A generous helper, but risky. They likely aren’t doing 24/7 monitoring, patching, compliance, or backups.
• No one – You’re not alone — but this leaves you exposed. Without someone actively managing IT and security, even simple threats can turn into business-ending problems.

Why this matters:
Most successful cyberattacks target known vulnerabilities — ones that could have been fixed with a simple update. Patching is your first and best defense against threats.

What your answer tells us:

• Automatic updates – Excellent. That means you’re likely closing vulnerabilities before attackers can exploit them.
• Monthly updates – Good, but there could be gaps depending on timing.
• Occasional or rare updates – This creates real risk. Attackers often scan for outdated systems because they’re easy targets.
• Not sure – A sign that no one is taking ownership. That usually means nothing is getting done.

Why this matters:
Backups are your lifeline after a ransomware attack, accidental deletion, or hardware failure. But they only help if they’re complete, automatic, and recent.

What your answer tells us:

• Daily, automated backups – That’s solid protection. Just be sure the backups are secure and tested.
• Weekly or monthly – Better than nothing, but could miss a lot of changes.
• Partial backups – Risky. You won’t know what’s missing until you need it.
• No backups or unsure – A single incident could result in permanent data loss or downtime.

Why this matters:
A backup you can’t restore is useless. Testing your ability to recover data is the only way to know your backup system actually works.

What your answer tells us:

• Regular recovery tests – That’s excellent. You’re validating your ability to bounce back from disaster.
• One test in the past year – Good start, but more frequent tests are safer.
• No tests or unsure – Huge risk. You might have bad backups and not even know it.

Why this matters:
MFA blocks 99% of credential-based attacks — even if your password gets leaked. It’s one of the easiest, most effective security upgrades out there.

What your answer tells us:

• MFA everywhere – Great! You’re dramatically reducing the risk of account compromise.
• MFA on some accounts – You’re partially protected, but attackers will look for weak spots.
• No MFA or unsure – That’s a serious vulnerability. Password leaks are common — MFA is what stops them from turning into breaches.

Why this matters:
Employees are your first line of defense — and often the first target. A single click on a phishing link can compromise your entire network. Training helps stop that.

What your answer tells us:

• Regular training – Excellent. Your team knows how to spot phishing and avoid risky behavior.
• One-off training – A good start, but people forget. Regular refreshers are key.
• No training or unsure – That leaves your team vulnerable and your business exposed.

Why this matters:
Most ransomware and business email compromise attacks start with a single malicious email. Basic spam filters aren’t enough anymore — advanced threats need advanced tools.

What your answer tells us:

• Dedicated platform – Great protection. These systems can block impersonation, phishing, and malware before they ever reach your inbox.
• Basic filtering – Better than nothing, but modern threats often slip through.
• No filtering or unsure – High risk. Your inbox is wide open to attacks.

Why this matters:
Weak or reused passwords are one of the most common causes of data breaches. A password manager makes it easy to use strong, unique passwords for every account — without remembering them all.

What your answer tells us:

• Company-wide password manager – That’s a smart move. You’re reducing human error and improving security across the board.
• Partial use – Better than nothing, but gaps still exist.
• No password manager – This puts your business at serious risk. Reused passwords are easy for attackers to crack.

Why this matters:
Many threats slip past firewalls and antivirus. Without monitoring, you may not even know you’ve been breached until it’s too late.

What your answer tells us:

• Dedicated monitoring tools– You’re in a good place. These systems catch issues early, often before damage is done.
• Occasional log checks – You might catch something eventually, but not fast enough.
• No monitoring or unsure – You’re flying blind. A hacker could be inside your network and you’d never know.

Why this matters:
If your business is subject to compliance rules, failure to meet them can lead to fines, lawsuits, and loss of customer trust. But even if you’re not required, compliance-ready practices are just good security.

What your answer tells us:

• Compliant with tools in place– You’re in great shape, assuming things stay updated.
• Working on compliance – That’s progress, but gaps still leave you exposed.
• Not sure or not compliant – You may be at risk without realizing it — especially if you handle sensitive customer or financial data.