1. Does your business use a system such as Microsoft Office 365 or Google G-Suite to manage your user accounts?

Do you use a system like these to manage how a user logs on to your system or access data?

2. Do you have an inventory of all IT hardware assets and software in use?

3. Do you have an inventory of your data and where it resides?

4. If you are using Microsoft Office 365 or Google G-Suite to manage your users and how they access the network. Do you have the users arranged in groups (ie: by department) so you can easily manage what data they have access to?

By having role based access controls, you can control who can access data. An example is only HR staff can access HR files.

5. Are all devices being used set to auto-update all sofware applications and operating systems?

1. Does your business back up all data?

2. Do you test your backups on a regular basis?

3. Do you have a disaster recovery plan so your organization can quickly resume work after a cyber incident or natural disaster?

4. Do you have a cyber incident response plan?

5. When you receive a new hardware device such as an internet router, hardware firewall, or wireless access point, it will have a default password enabled on it. Has this default password been changed on all such devices?

1. Do you have an ongoing cybersecurity awareness training program for all employees on how to recognize security threats?

2. Are employees instructed to keep their work and personal accounts separate?

3. If you suffered a data breach or cyber-attack today, do you know how to respond?

4. Are employees trained on physical security and privacy?

5. Do you have incident response responsibilities assigned to a staff person or multiple staff?