Cyber Security Readiness Checklist
Twenty-three questions to answer before an incident answers them for you.
Where to start when you are ready to improve.
Attackers rarely need a new trick. They need one stolen password, one machine missing an update, or one backup they can reach. Work down the list and mark only what is genuinely in place today. Every No or Not sure is a conversation worth having.
These are written as capabilities rather than products, so you can measure whatever you already own against them. Your answers stay in your browser and are never sent anywhere.
Line 1
Prevent
Keep threats away from your people and systems.
Multifactor authentication on every account, with no exemptions.Administrators and shared mailboxes included.
Older sign-in methods disabled, and sign-in rules applied.Limits which devices and locations reach your data.
Mail filtering on links and attachments, plus published sender records.Email is still the most common way in.
Security awareness training with regular simulated phishing.Measured by who clicks and who reports.
Updates on a schedule, for applications as well as operating systems.With reporting on what actually installed.
Administrator accounts kept separate from everyday accounts.No mail or browsing from a privileged account.
Control over what software and remote access tools may be installed.Including anything a vendor installs.
Line 2
Detect & Respond
Assume prevention fails. Catch it and shut it down.
Endpoint detection with trained analysts watching around the clock.Software alone is not response.
Monitoring of the identity platform itself, not only the devices.Stolen sign-ins, new mail forwarding rules.
Logs collected centrally and kept long enough to be useful.Intruders often sit quietly for weeks.
A known escalation path outside business hours.Who is called, and who may disconnect a system.
Regular access reviews, with unused accounts and stale rights removed.Former staff, vendors, scheduled tasks.
Line 3
Recover
The last recourse. Bring the business back.
Backups that cannot be altered or deleted, with their own credentials.Not reachable from the systems they protect.
Cloud mail and file data backed up independently of its platform.Recycle bins are not a backup.
A periodic offline copy kept away from the network.A rotated drive in a safe or offsite.
Restores tested by actually restoring, with a known recovery time.Measured against the downtime you can absorb.
Printed copies of what is needed to operate with no systems at all.Contacts, insurance, payroll, banking.
Line 4
Be Ready
Decisions made calmly now, not under pressure later.
A written incident response plan, with named roles and named backups.Rehearsed by the people in it.
The plan tested in a tabletop exercise and updated afterward.Leadership involved, not only technical staff.
Cyber insurance reviewed, with the carrier as the first telephone call.Your policy sets the team and the pace.
A relationship with a breach attorney established in advance.Privilege shapes what gets written down.
Prepared wording for staff, clients and any regulator that applies.And a way to reach people if mail is down.
Sensitive data you no longer need identified and removed.What you do not keep cannot be taken.
You can see results at any point. Unanswered questions are not counted.
Want to talk through your gaps?
Every No or Not sure is a conversation worth having. Call or email, and a person will give you an honest answer, not a sales sequence.
Why these particular questions. In January 2025 our team responded to a ransomware attack on a former client. Administrative credentials were captured through a counterfeit application installed by an incoming technology provider. The intruder waited six weeks, then removed data, encrypted every server and a third of the workstations, and deleted both the onsite and the offsite backups. Recovery ran eighteen days, and the intruder returned on day six through a leftover scheduled task. Every line above traces back to that response or to established prevention practice. TANSTAAFL: there is no free lunch in security, so we would rather show you the whole list than sell you one layer of it.
A general planning aid, not a tailored assessment. See who delivers each line.