Access Control
Multi-factor authentication enabled for all usersCritical
Password policy enforced (length, complexity)Critical
Password manager used organization-wide
Least privilege access (users only have needed access)
Email Security
Advanced email filtering/anti-phishing enabledCritical
DMARC, DKIM, and SPF configured
Regular phishing awareness training conducted
Endpoint Security
Endpoint detection & response (EDR) on all devicesCritical
Device encryption enabled (BitLocker/FileVault)Critical
Automated patch management in place
Mobile device management (MDM) for company devices
Network Security
Business-grade firewall with active monitoringCritical
Secure WiFi with WPA3 or WPA2-Enterprise
VPN required for remote access
Data Protection
Automated backups with off-site/cloud storageCritical
Backups tested for restoration within last 90 days
Data loss prevention (DLP) policies configured
Incident Response
Documented incident response plan exists
24/7 security monitoring in place
Answer all questions to see your score