How exposed is your business?

What good looks likeA code or app approval in addition to the password — for every user, not just some.

If not, fix itTurn on MFA for every user’s email, VPN and remote access. It blocks the vast majority of account takeovers.

What good looks likeAdmin access kept to separate accounts used only by IT.

If not, fix itRemove everyday admin rights and use separate admin accounts. It stops most malware from installing itself.

What good looks likeNo spreadsheets, sticky notes or one password for everything.

If not, fix itRoll out a business password manager so every account gets a unique password and shared logins are controlled.

What good looks likeEndpoint detection and response (like SentinelOne), monitored 24×7 — not just free antivirus.

If not, fix itPut managed EDR on every computer and server, with a 24×7 SOC watching the alerts.

What good looks likeIncluding third-party apps like browsers, Zoom and Adobe.

If not, fix itAutomate operating-system and third-party patching, and track anything that’s falling behind.

What good looks likeBitLocker or FileVault, managed centrally.

If not, fix itEncrypt every laptop and enroll devices in management so a lost or stolen one can be locked and wiped.

What good looks likeAdvanced filtering for phishing links, attachments and impersonation.

If not, fix itAdd advanced email security that checks links and attachments and flags impersonation of your executives and vendors.

What good looks likeAnnual training plus simulated phishing emails every quarter, with results tracked.

If not, fix itStart annual security awareness training with quarterly simulated phishing so your team learns to spot and report scams.

What good looks likeOff-site or immutable copies — not just a USB drive or sync folder.

If not, fix itBack up servers and cloud email and files off-site, with copies ransomware can’t encrypt or delete.

What good looks likeActually restoring files or a server, not just checking that backups ran.

If not, fix itSchedule restore tests and document how long recovery takes, so you know the backups work before you need them.

What good looks likeIncluding your insurer, IT provider, bank and legal contacts.

If not, fix itWrite a one-page incident response plan with names, numbers and first steps, and walk through it once a year.

What good looks likeA person or team actually looking — ideally 24×7 — not just alerts going to an inbox.

If not, fix itGet 24×7 monitoring with a team that reviews alerts and vulnerability scans and acts on them.