A structured baseline check for organizations that do not have a security team. Twelve questions, about five minutes, and a prioritized answer at the end. No email address, no account, and no answers leave your browser.
What This Checks
The questions cover the six domains where gaps cause the most damage in small and midsize organizations: identity, patching, backup, endpoint, email, and response. Each question is scored 0 (no), 1 (partly), or 2 (yes), for a maximum of 24 points.
This is a baseline check. It is not a compliance audit, not a penetration test, and not a substitute for someone inspecting your actual configuration and logs. It tells you where to look first.
Take the Assessment
Twelve questions across six domains. Score each one 0, 1, or 2. Answers stay in your browser; nothing is sent or saved.
Score 0–8: Critical gaps — Core controls are missing. Treat this as the top priority.
Score 9–15: Basic controls, material gaps — Some basics are in place. Several gaps still expose you.
Score 16–20: Reasonable baseline, test it — The foundation is there. Prove it with a restore test and an independent review.
Score 21–24: Strong baseline, validate independently — Controls look solid. Independent validation is the remaining check.
How to Read Your Score
| Score | Band | What it means |
|---|---|---|
| 0–8 | Critical gaps | Core controls are missing. Treat this as the top priority this month. |
| 9–15 | Basic controls, material gaps | Some basics are in place. Several gaps still expose you to a routine attack. |
| 16–20 | Reasonable baseline, test it | The foundation exists. Prove it with a restore test and an independent review. |
| 21–24 | Strong baseline, validate independently | Controls look solid. Independent validation is the remaining check. |
The domain subtotals matter more than the total. A score of 14 with zero points in backup is a different problem from a score of 14 spread evenly.
What to Do Next
- Below 9: fix MFA, backups, and patching in that order, then run the check again. If you have no one to do that work, call us.
- 9–15: run a proper cybersecurity assessment so the gaps are confirmed with evidence rather than self-report.
- 16 and above: validate with an independent assessment, and test the incident response plan. A baseline you have never exercised is an assumption.
Whatever your score, write the incident response plan next. The free template takes about an hour to fill in. The small business cybersecurity guide explains the ten controls behind these questions in detail.
If the assessment raises something you need help with, the incident response and compliance teams work from the same evidence.
Schedule a free consultation or call 703-486-0200.