Thirteen questions on the controls that decide whether a bad day stays a bad day. Built for small businesses across Chester County PA, northern Delaware, and northern Maryland, though the questions apply anywhere.
13 questions, about two minutes. Everything runs in your browser and nothing you enter is sent anywhere.
Ordered by what each gap costs you if it is the one that goes wrong, not by how easy it is to fix.
Partial coverage is the version attackers count on. They do not need the accounts that are protected, only the one that is not, and the account most often left out is a shared mailbox or an administrator login, which are the two worth the most to them.
Try this: Ask whoever manages your email to list every account that can sign in without the second step. If that list cannot be produced in ten minutes, the gap is bigger than the answer suggests.
What fixing it involves: Turning it on for the remaining accounts is usually an afternoon, most of which is helping people set up the app on their phones. There is no licence to buy in Microsoft 365 or Google Workspace.
A password is the one control that is already for sale. Stolen credentials get resold in bulk, and the first thing bought is business email, because that is where invoices and payment instructions live. This is also the single control a cyber insurance application asks about first.
Try this: Search your own name and company domain on haveibeenpwned.com. If anything comes back, assume those passwords are known and treat this as urgent rather than scheduled.
What fixing it involves: This is the highest-value fix on the list and usually the cheapest. Both Microsoft 365 and Google Workspace include it. The work is enrolment and a short explanation to staff, not new software.
This is the answer I hear most, and it usually means it was switched on for some people at some point and never audited. An insurer will not accept "I think so" on an application, and neither will a bank after a fraudulent transfer.
Try this: Sign out of your own work email on your phone and sign back in. If a password alone gets you in, you have your answer for at least one account.
What fixing it involves: Checking is quick, an admin can read the state of every account in one screen. Whether anything then needs turning on depends on what that screen says.
When the account someone reads email on is also the account that can install anything, a single bad click gets to run with full control of that computer. Removing that one privilege stops a large share of ordinary malware without buying anything.
Try this: On any staff computer, try installing something harmless. If it installs without a prompt for a separate password, the privilege is there.
What fixing it involves: Staff move to standard accounts and a separate credential is used for installs. The friction is real for the first fortnight and then people stop noticing. Worth planning around whatever line-of-business software you run, which is usually where the exceptions are.
In practice this usually means everyone can, because it is the default when computers are set up one at a time as they are bought.
Try this: Same test as above, on the oldest computer in the office rather than the newest. Machines set up years ago are the ones that kept the default.
What fixing it involves: Auditing this is quick. Changing it is a short project, and worth doing at the same time as any device refresh.
The window between a resignation and the account being closed is when data leaves quietly. It is rarely malice, it is usually someone copying their own work. It still counts as a breach if that data belongs to your clients.
Try this: Pick the last person who left and check whether their email, file access, phone system login, and any industry software account are all actually closed. The one that is still open is almost never email.
What fixing it involves: A written offboarding checklist covering every system, not just email, run on the last day. The checklist matters more than the tooling.
Dormant accounts that nobody watches are ideal for an intruder, because no real person notices the sign-in. They also quietly cost money in licence fees, which is often what finally gets them found.
Try this: Ask for a list of every account that has not signed in for 90 days. Cross-check it against your current payroll. Anyone on the first list who is not on the second is an open door.
What fixing it involves: Close what is stale, then put a checklist in place so it does not rebuild. This is one of the clearest arguments for handing user setup and removal to a provider, because it is the task that gets skipped when everyone is busy.
Protection that nobody watches tells you nothing. A computer whose protection expired, failed, or was switched off by a user looks exactly like a healthy one from across the office. Alerts that arrive on the affected machine and nowhere else are alerts nobody reads.
Try this: Ask for the number of computers currently reporting as protected, and compare it to the number of computers you own. Those two numbers are rarely the same, and the gap is the finding.
What fixing it involves: Central visibility rather than new software. This is core to a managed plan and is the first thing I put in place, because everything else is guesswork without a device count you trust.
What ships with Windows is genuinely decent now, so this is not the emergency it once was. The gap is not detection, it is that nothing reports centrally. Nobody finds out a machine is infected until the person using it notices, which is usually well after the useful moment.
Try this: Ask when anyone last saw a security alert from any computer in the office. If the answer is never, that is either very good news or no alerting at all, and there is no way to tell which from where you are sitting.
What fixing it involves: Managed protection with central reporting, sized per device. Modest monthly cost, and it is what turns "we think we are fine" into a number you can check.
Update prompts arrive mid-task and get postponed, then postponed again. The machines that fall furthest behind belong to the busiest people, who are usually the ones with access to the most.
Try this: Walk to three computers and check the last installed update date. If any is more than six weeks old, the honest answer to this question is no.
What fixing it involves: Updates get scheduled and reported centrally rather than left to prompts. Part of a managed plan, and it removes the argument about who forgot.
Almost every widely exploited weakness has a fix available before it is used at scale. Unpatched machines are not unlucky, they are the ones nobody was counting.
Try this: Ask for a list of your computers and the date each last updated. If no such list exists, that is the finding, and it takes about a day to produce the first time.
What fixing it involves: An inventory first, then scheduled patching with reporting. The inventory is the part with lasting value, because it also settles what you own and what it is costing you.
Old hardware rarely fails politely. It fails on a deadline, and the replacement then gets bought at whatever price and lead time the day allows. Machines this age also start dropping off supported Windows versions, which turns a hardware decision into a security one.
Try this: Add up what an unplanned failure actually costs: the machine at retail, plus a day of that person not working, plus whoever sets it up. Compare that to replacing two a year on a schedule.
What fixing it involves: A replacement plan spread over a few years rather than a bad quarter. Not urgent, but it is the item most often left until it is.
At this point failures stop being individual events and become a run of them. It also usually means several machines cannot take the current version of Windows, so they stop getting security updates on a date already published, whatever anyone decides.
Try this: Check what version of Windows the oldest machines run, and look up the support end date for it. That date is your deadline and it will not move.
What fixing it involves: A refresh plan with dates and costs, phased so it is a budget line rather than an emergency. This is worth putting on paper before the first one dies rather than after.
An untested backup is a plan, not a capability. The failures that matter show up only during a restore: the backup that has been failing silently for months, the one system nobody included, the restore that works but takes nine days. You find out which one you have on the worst possible morning.
Try this: Ask for the date of the last full restore test and which file came back. A date and a filename is a real answer. Anything vaguer than that is a no.
What fixing it involves: A test restore, then a schedule for repeating it. The first one is where the surprises are, which is exactly why it is worth doing while nothing is wrong.
This is the finding that decides whether an incident is an expensive week or the end of the business. Everything else on this list is about lowering the chance of a bad day. This one is about whether you survive it.
Try this: Pick the one system you could least do without for a week. Ask a single question about it: if it was gone tomorrow morning, what exactly is the plan? Whatever comes back is your real recovery plan.
What fixing it involves: Start with what must survive rather than with products: which systems, how much work you can afford to lose, and how long you can be down. Everything after that is sizing.
Backups drift. New systems get added and never included, folders move, a job starts failing and the alert goes to someone who left. A test that passed last year says nothing about what would happen this week.
Try this: Ask for a file from a random folder, from a date about a month ago, restored today. Time how long it takes. The duration is as informative as whether it works.
What fixing it involves: A quarterly restore test with the result written down. Fifteen minutes, and it converts an assumption into a fact.
Backup software reports on whether it ran, not on whether what it produced is usable. Those are different questions, and only one of them matters at the point you need it.
Try this: Ask to see a file come back from backup, in front of you, today. This is the single most useful question on this whole list, and the reaction to it usually tells you the answer before the test does.
What fixing it involves: One test restore now to find out where you actually stand, then a schedule. If it fails, better to learn that today than during an incident.
This is the most common wrong assumption I find, and it is a reasonable one to have made. The retention built into these platforms is short and it is designed for accidents, not for a compromised account quietly deleting a year of mail, or for a departure dispute six months later.
Try this: Ask what happens if a mailbox is deleted today and the loss is noticed in four months. If the answer involves the built-in recycle bin, check its retention period, then compare that to four months.
What fixing it involves: Independent cloud-to-cloud backup, priced per mailbox, and typically a small monthly cost. It is one of the cheapest gaps on this list to close.
Worth resolving because the answer is usually no, and because it is inexpensive to fix once someone actually asks the question.
Try this: Ask your provider, or whoever set up your email, one question: if a mailbox is deleted and nobody notices for three months, can we get it back? The hesitation is the answer.
What fixing it involves: Confirm what retention you have today, then decide whether it covers a realistic timeline. Often it does not, and closing the gap is a small monthly line.
These requests are convincing, they arrive during a genuinely busy week, and they often come from a real supplier mailbox that has been compromised. An unwritten rule holds until the person who holds it is on holiday and someone helpful covers for them.
Try this: Ask the person who pays your invoices what they would do with that email. If the answer starts with "I would probably", it is not yet a control.
What fixing it involves: One written rule, agreed once: bank detail changes are confirmed by phone to a number already on file, no exceptions, no matter who appears to be asking. Costs nothing and is the single highest-value process control on this list.
This is the fraud that takes the most money from businesses this size, and it does not require any technical compromise on your side to work. The money leaves by an authorised transfer that your own staff make, which is also why it is so hard to recover and why insurers treat it as its own category.
Try this: Ask whoever pays suppliers to walk you through what happened the last time bank details changed. Not what should happen. What did.
What fixing it involves: Agree the rule this week and put it in writing. It is free, it takes one conversation, and it is the fix on this list with the shortest distance between deciding and being done.
The value is not the content, it is recency. A one-off session years ago has been overwritten by everything since. It also misses everyone hired after it.
Try this: Ask three people what they would do with an email from you asking them to buy gift cards urgently. Three different answers means there is no shared rule.
What fixing it involves: Short refreshers rather than an annual lecture, plus a clear route for reporting something suspicious without feeling foolish. The reporting route matters more than the training.
Your staff are the control that faces every attack first, and usually the one nobody has briefed. Most people are perfectly willing to be careful, they have simply never been told what careful looks like here.
Try this: Ask your team where they would report an email they thought was suspicious. If there are several answers, or a pause, there is no route.
What fixing it involves: Start with the route, not the training: one address or one person, and a rule that reporting something harmless is always the right call. Training builds on that.
A personal machine is outside everything you have put in place: no managed updates, no visibility, shared with a household, and it stays in that household when the person leaves. Whatever was downloaded to it goes too.
Try this: Ask one person who works from home where the file they edited last night is saved. If the answer is a folder on their own machine, that is where your data lives now.
What fixing it involves: Either issue company machines for remote work, or set a rule that company data stays in company systems and is only worked on there. The second is cheaper and works if the tools make it the easy path.
At this point the boundary of your business is undefined. You cannot say which machines hold your data, what state they are in, or what happens to any of it when someone leaves. That is also difficult to answer on an insurance application in a way you would want to sign.
Try this: Try to write down every computer that has touched company data in the last month. The point of the exercise is discovering whether the list can be finished.
What fixing it involves: Decide where work is allowed to happen, then make that the easiest option. Company devices for the people who need them, and everyone else working inside the cloud tools rather than on local copies.
This routes every problem through one or two informal helpers, which is fine until they are on leave. It also means nothing is recorded, so recurring problems never get recognised as recurring and get solved from scratch each time.
Try this: Count how many of the last five problems were solved by the same person who was never hired to do it. That is your real IT department, and it is unfunded.
What fixing it involves: One route in, with a record. The record is the valuable part, because it turns "it keeps doing this" into a pattern with dates on it.
Problems get reported late or not at all, because reporting them is more effort than working around them. The workarounds then quietly become how the business runs.
Try this: Ask your team what they currently just live with. The list is usually longer than expected, and most of it was never reported to anyone.
What fixing it involves: A single documented route to report a problem, whether that is internal or a provider. This is the least technical fix on the list and often the one people notice most.
That is genuinely uncommon. It is worth saying that this tool can only reflect what you told it, so the useful next step is checking whether the answers hold up under inspection rather than adding more controls.
I will go through your results with you on a 15 minute call and tell you which items genuinely need attention and which can wait. No charge, and no obligation to become a client.
Book a 15 minute callI will send your score and the full list of findings as a document you can keep, forward to your provider, or put in front of your insurer. One email, and I do not add you to a list.
It assumes you run the business rather than the network. If you can answer questions about how your office works, you can complete it.
The incidents that actually shut a business down for a week are rarely exotic. They come from a short list of controls that were never turned on, or were turned on once and never checked again. This walks that list.
Every question is one you can answer from your own desk, in plain business language. Where a term is unavoidable I explain it. If the honest answer is that nobody knows, that is a valid answer and it counts, because not knowing is itself the finding.
A missing backup does not weigh the same as a missing device list, so the score does not treat them the same. Fifteen yes answers is a meaningless number. What matters is which ones are no.
The whole thing runs on your own computer. No account, no email required to see the result, and no answers sent anywhere unless you choose to have the report emailed to you at the end.
Counting yes answers would make this useless, because it would rate a missing device list the same as a missing backup. Each answer carries a weight instead.
| What is missing | Weight | Example from this check |
|---|---|---|
| Critical control missing | 15 points | No working backup, or no multi-factor sign-in on email |
| High-risk control missing | 10 points | Restores never tested, or cloud data with no separate backup |
| Moderate gap | 5 points | No security training in the last year, or no clear route for reporting a problem |
It is scaled, not subtracted. There are more than 100 points of possible weight in this check, so the score is your weighted total expressed against the worst case rather than counted down from 100. That keeps it honest at both ends.
Missing critical controls cap the rating. One missing critical control holds the overall rating at "needs attention" or lower whatever the number says, and two or more hold it at "high risk". A business with everything else in place and no working backup is not in good shape, and a number on its own would tell you it was. Where that happens, the result says so rather than quietly adjusting the score.
It reflects what you told it. It has not looked at anything, so it cannot find the gap you did not know you had, and that is usually the one that matters. It is a two minute triage, not an audit, and the difference is the whole difference.
It is free and you see the full result without entering anything. Email is only needed if you want the report sent to you as a record, which is optional.
Each question carries a weight rather than counting equally. A missing critical control such as untested backups costs far more than a missing nice-to-have such as a guest Wi-Fi network. The score is the weighted total expressed out of 100. Missing critical controls also cap the overall rating regardless of the number, because a business with everything else right and no working backup is not in good shape.
Nothing is sent anywhere. The whole tool runs in your browser and the score is worked out on your own computer. If you choose to have the report emailed, that submission is the only time anything leaves your machine, and it goes to me.
It counts against the score, and that is deliberate rather than harsh. If nobody can say whether backups work or whether multi-factor sign-in is enforced, you are relying on it being true, which is a different position from knowing it is. Not knowing is a real finding on its own.
No, and the difference matters. This asks what you already know and organises the answers. The Network Security Assessment goes and checks: it is on site, covers over 45 controls, and produces a written report, a remediation roadmap with real costs, and a cyber insurance answer sheet. This tool cannot verify anything, it can only reflect what you told it.
Most first scores are somewhere in the middle, and the pattern is nearly always the same: a few high-value controls were never switched on, usually because nobody owned the job. The order in the result is the order I would fix them in, and the first two are usually cheap.
No. Every question is written to be answerable by an owner or an office manager without checking anything first, and where a technical term is unavoidable it is explained under the question.
I am Christopher Abt, and I run SolviTech IT Solutions, a managed IT and cybersecurity practice serving Chester County PA, northern Delaware, and northern Maryland. I have worked in IT for 30 years. The weightings here reflect what I actually see cause damage in businesses this size.
All free, all a couple of minutes, and none of them ask for anything before showing you the answer.
Put a number on what an outage costs you, using your figures rather than anyone else’s.
Start itTen questions on whether you have outgrown calling someone when it breaks.
Start itTwelve questions on the tenant settings that decide whether one stolen password becomes an incident.
Start itI will walk through what came back, tell you which items genuinely need attention and which can wait, and you are under no obligation after it.
Free, no obligation, and you talk directly with a senior engineer.