How safe is your business from a break-in?

Does everyone need a code or app approval (not just a password) to sign in to work email?

This is called two-step or multi-factor sign-in.

Is two-step sign-in also on for banking, payroll and your accounting software?

Anything that can move money or show staff details.

Does your team use a password manager instead of reusing passwords or keeping a list?

A notebook, spreadsheet or sticky note counts as a list.

Do people do their everyday work on accounts that cannot install software or change settings?

Admin rights are kept for a separate login used only when needed.

Is your email domain set up so others cannot easily send mail pretending to be you?

Your IT provider may call this SPF, DKIM and DMARC. "Not sure" is a fine answer.

Has your team been shown how to spot fake emails and texts in the last year?

A short session or a practice test email both count.

Do all work computers install Windows or Mac updates on their own?

Including laptops that go home.

Does every work computer have security software that someone actually watches?

Built-in Microsoft Defender is fine if alerts go to someone.

If a laptop were stolen, would the files on it be locked (encrypted)?

On Windows this is BitLocker; on Mac it is FileVault.

Do you have an up-to-date list of every computer and phone used for work?

Including personal phones that get work email.

Are your important files and email backed up automatically every day?

Files only saved in OneDrive or Google Drive are synced, not backed up.

Is at least one copy of the backup kept where ransomware on your network cannot reach it?

For example a cloud backup that cannot be deleted for 30 days.

Has anyone actually restored files from the backup in the last six months?

A backup nobody has tested is a hope, not a plan.

Do guests and personal devices use a separate Wi-Fi from your work computers?

A "guest" network on your router counts.

Is your office router or firewall less than five years old and getting updates?

If it came from your internet provider and nobody has touched it, answer "not sure".

When someone leaves, are all their logins shut off on their last day?

Email, shared passwords, apps, building codes.

If you were hacked tomorrow, does everyone know who to call first?

A one-page plan with phone numbers is enough.

Do you have cyber insurance, and do you know what it asks you to have in place?

Many policies require two-step sign-in and backups before they pay out.