Skip to content

Free tool · SME cyber security checklist

How secure is your business? Get your score in 3 minutes.

Fifteen quick questions on the basics every UK small business should have in place. You'll get an instant security score, a breakdown across five areas, and the three fixes that will cut your risk the most. Nothing is sent unless you ask for your action plan.

  • Built on Cyber Essentials and NCSC guidance
  • Instant score, no login
  • Your top three fixes, in plain English
Prefer to talk? Book a 15-minute call
  • Takes 3 minutes
  • No obligation
  • UK-based experts
100% free
SME cyber security checklistFive areas, three questions each. Choose "Not sure" if you don't know.

Free security score

How well protected is your business?

Step 1 of 5

  • Takes 3 minutes
  • Nothing sent until you ask
  • Instant result

People

Is multi-factor login (MFA) switched on for every email account?Stolen passwords are the most common way in. MFA blocks most of those attacks.

Have staff had phishing or scam awareness training in the last 12 months?Most attacks start with an email someone clicks.

Do you confirm bank detail changes by phone before paying?Invoice fraud costs UK SMEs thousands per incident.

Devices

Are updates installed on every laptop and phone within 14 days?Unpatched software is how ransomware gets in. Cyber Essentials requires 14 days.

Does every device have managed antivirus or EDR that someone monitors?Unmonitored antivirus misses modern attacks and nobody acts on alerts.

Are laptops encrypted, so a lost device does not leak data?A lost unencrypted laptop is a reportable data breach.

Accounts

Do staff use normal accounts day to day, not admin accounts?Admin rights let malware install itself and spread.

When someone leaves, are their accounts disabled the same day?Old accounts are an easy, unnoticed way in.

Do staff use a password manager instead of reusing passwords?Reused passwords leaked from other sites unlock your systems.

Data

Are your files and email backed up, with a copy attackers can't reach?Ransomware targets backups first.

Have you tested restoring from backup in the last 6 months?Many businesses discover their backups don't work during an incident.

Is your email domain protected with DMARC, so criminals can't send as you?Without DMARC, anyone can send emails that look like they came from you.

Response

Is someone watching for attacks outside office hours?Attacks are often launched at night and at weekends.

Do you have a written plan for what to do if you are hacked?A plan cuts downtime and helps you meet reporting deadlines.

Do you hold Cyber Essentials, or are you working towards it?Clients, tenders and insurers increasingly ask for it.

Your result

Your security score

Score by area

  • People0%
  • Devices0%
  • Accounts0%
  • Data0%
  • Response0%

Your top three fixes

    Talk Through My Results
    Or talk to us now:WhatsApp us01483 668 400
    • 3 minto complete
    • Security scoreinstant insight
    • NCSC-alignedUK guidance

    Five areas attackers check first

    Most attacks on small businesses don't need sophisticated tools. They use the same handful of gaps, again and again. The checklist covers each one.

    • People

      Phishing, payment fraud and logins without multi-factor protection.

    • Devices

      Missed updates, unmonitored antivirus and unencrypted laptops.

    • Accounts

      Admin rights, reused passwords and leavers who keep access.

    • Data & response

      Backups attackers can reach, email spoofing and no plan for the worst day.

    Want us to check for you?

    Our free risk check looks at your business from the outside and tells you where you're exposed, in plain English.

    Speak to a Specialist
    • Free, no obligation
    • UK-based team
    • Reply within 1 business day