Skip to content

How secure is your business?

Answer 12 questions about how your business signs in, protects devices and backs up data. You get a score out of 100 and a list of what to fix first. It takes about three minutes.

Everything runs in your browser. Nothing you answer is stored or sent to GlobeVM.

0 of 12 answered

Sign-in and accounts

Does everyone use multi-factor sign-in (MFA) for email, Microsoft 365 or Google, and remote access?

MFA means a second step after the password, such as an app prompt or a security key.

Do admin accounts use phishing-resistant MFA, such as passkeys or security keys?

Text codes and push approvals can be phished or tricked. Passkeys and security keys can't be used on a fake site.

Devices

Are security updates for computers, servers and firewalls installed within 14 days of release?

Count everything: Windows and Mac, servers, firewalls, and apps like browsers.

Does every computer and server run endpoint detection and response (EDR), not just basic antivirus?

EDR watches for suspicious behavior and can isolate a device. Basic antivirus mainly looks for known bad files.

Do staff work without local administrator rights on their computers?

Answer yes only if day-to-day accounts can't install software or change security settings.

Email

Is incoming email filtered for phishing and malware, and is your domain's DMARC policy set to quarantine or reject?

Not sure about DMARC? Run the free email security check

Backups

Do you keep 3-2-1 backups (3 copies, 2 types of storage, 1 off-site) and have you tested a restore in the last 90 days?

A backup you've never restored from is a hope, not a plan.

Is at least one backup copy immutable or offline, so it can't be changed or deleted from your network?

Immutable means locked for a set time. Ransomware groups often try to delete backups first.

People and process

Does your team get security awareness training at least once a year, plus regular phishing tests?

Phishing tests are safe practice emails that show who would have clicked.

When someone leaves, are all their accounts and access removed on their last day?

Include email, Microsoft 365 or Google, VPN, shared passwords and cloud apps.

Do you have a written incident response plan that says who to call and what to do first?

It should cover ransomware, a hacked email account and lost devices, and be reviewed at least yearly.

Have you checked that you meet every security control your cyber insurance policy requires?

Insurers commonly ask about MFA, EDR and backups on applications. If you don't have a policy, answer no.