Answer 6 practical questions to evaluate your posture against UK Cyber Essentials, CIS Controls v8.1 IG1, and common ransomware extortion risks. Zero client data or personal identifiers are stored.
Check 1 of 6 • Identity & Cloud Access
How is Multi-Factor Authentication (MFA) enforced across your team?
MFA blocks over 98% of automated account compromise attempts in Microsoft 365 and Google Workspace.
Enforced for 100% of staff and admin accounts
Via Security Defaults, Conditional Access, or Google 2-Step Verification with company recovery codes.
Enforced for IT/Administrators only
Standard staff mailboxes and cloud accounts sign in with a single password.
Optional, not enforced or unsure
Individual staff decide whether to switch on two-step verification.
Check 2 of 6 • User Privileges
Do staff use standard non-administrative accounts for daily work?
Removing local administrator rights stops malicious payloads and ransomware from executing freely on endpoints.
Yes, standard user accounts for everyone
A separate named support account is kept strictly for software installation and system changes.
Some staff have local admin rights on laptops
Senior managers, engineers, or early employees have permanent administrator privileges.
Most or all staff are administrators on their PCs
Staff can install any software, browser extension or driver without IT intervention.
Check 3 of 6 • Data Resilience & Ransomware
How are your Microsoft 365, Google Workspace, and server data backed up?
Cloud platforms protect their own uptime, not accidental deletion, ransomware encryption, or rogue admin wipeouts.
Independent cloud-to-cloud backup with tested restores
Stored outside the primary tenant with separate admin logins and quarterly restore verification.
Relying on OneDrive, Google Drive and Recycle Bins
Synced folders and 30-day cloud recycle bins are the only recovery mechanism.
Local USB drives, unmonitored NAS, or no backup
Backups are manual, untested, or physically connected to the office network.
Check 4 of 6 • Vulnerability Management
How quickly are security updates applied to laptops, phones, and firewalls?
Cyber Essentials requires critical and high-risk security updates to be installed within 14 days of release.
Automated updates installed within 14 days
Windows, macOS, browser and office updates are centrally forced or verified monthly.
Staff are reminded to click update, but not verified
Updates depend on individual employees restarting their computers.
Ad-hoc, unsupported devices (e.g. Windows 10 past EOL) in use
Older machines running legacy operating systems remain connected to the business network.
Check 5 of 6 • Device & Data Security
Are laptops protected with full-disk encryption and modern endpoint defence?
A lost or stolen laptop without BitLocker or FileVault is an immediate reportable personal data breach under UK GDPR.
BitLocker / FileVault active on all mobile devices + active EDR
Recovery keys are held in cloud escrow, and centralised malware detection alerts on suspicious activity.
Basic antivirus installed, but encryption is not verified
Some laptops may have BitLocker active, but recovery keys and status are not recorded.
No disk encryption and unmanaged consumer antivirus
Mobile laptops leave the office unencrypted without central monitoring.
Check 6 of 6 • Payment Fraud & Governance
How does your team verify requests to change supplier bank account details?
Invoice redirection and supplier impersonation fraud account for the largest direct financial losses among UK SMBs.
Mandatory verbal call-back to a known trusted phone number
Staff never use contact details found on the incoming invoice or email, plus two-person sign-off.
Informal checks, often trusting email confirmations
Staff ask the supplier by replying to the same email chain to confirm details.
No formal verification procedure in place
Bank details on new invoices are entered directly into online banking without independent verification.
