Do all users need MFA (a code or app prompt) to log in to email?

MFA means a second step after the password, like a text code or authenticator app.

Is MFA required for all remote access (VPN, remote desktop, cloud apps)?

Includes any way to reach your systems from outside the office. Choose Yes if you have no remote access.

Do admin and IT accounts use MFA?

Accounts that can change settings, add users, or manage servers.

Do you keep backups offline or separate from your network, and have you tested a restore in the last 6 months?

A backup ransomware can't reach, and proof it actually works.

Do all computers and servers have up-to-date endpoint protection (EDR or modern antivirus)?

EDR watches for suspicious behavior, not just known viruses.

Are Windows, Mac, and key software updates installed within about 30 days?

Including browsers, Office, and firewalls or routers.

Do you filter email for spam, phishing, and bad attachments?

Microsoft 365 and Google Workspace include filtering, but settings matter.

Has everyone had phishing or security awareness training in the last year?

Short videos or simulated phishing emails count.

Do people use normal (non-admin) accounts for everyday work?

Admin rights only when needed, on separate accounts.

Do you have a written plan for what to do if you get hacked or hit by ransomware?

Who to call, what to shut off, how to reach your insurer.

Do outside vendors or IT helpers use secure, approved remote access that you can turn off?

Not shared passwords or always-on remote tools.

Are laptops and devices with sensitive data encrypted?

BitLocker on Windows or FileVault on Mac.

Important disclaimer

This self-check is general information only. CyberDefense Consulting LLC is not an insurance broker or agent and does not provide insurance advice or guarantee coverage or premiums. Always answer insurance applications truthfully.