Complimentary Cyber Risk Assessment

How secure is your business?

Answer twenty practical questions and receive an immediate cyber-readiness score with prioritized recommendations. Most organizations finish in under five minutes.

Start Assessment How It Works

72Sample readiness score

Identify gaps. Prioritize improvements. Start a better conversation.

What You'll Receive

A fast, practical view of your cyber readiness.

Readiness Score

A score from 0–100 based on twenty common business-security controls.

Priority Recommendations

Immediate suggestions based on the areas where your answers indicate the greatest risk.

Printable Summary

Print or save your results as a PDF for internal planning or board discussion.

Security Area 1

Do all employees use multi-factor authentication?

MFA greatly reduces the risk of account takeover.

Yes, for all important accountsFor some accounts or usersNoNot sure

Security Area 2

Are business backups monitored and routinely tested?

A backup is only useful when it can be restored.

Monitored and tested at least quarterlyBackups exist but testing is infrequentBackups are not independently monitoredNo reliable backup process

Security Area 3

Do computers use managed endpoint detection and response?

Modern protection should detect suspicious behavior, not only known viruses.

Yes, centrally managed EDRStandard antivirus onlyNo managed protectionNot sure

Security Area 4

Are operating systems and business applications patched centrally?

Unpatched software is a common entry point for attackers.

Yes, automatically and centrally managedMostly, but manuallyInconsistentlyNot sure

Security Area 5

Does your business use a supported, managed firewall?

A business firewall should be current, monitored, and properly configured.

Yes, supported and managedSupported but not actively managedAging or unsupported equipmentConsumer router only / not sure

Security Area 6

Is business email protected beyond a basic spam filter?

Email remains one of the most common attack paths.

Advanced filtering plus MFA and security controlsBasic filtering and MFABasic spam filtering onlyNot sure

Security Area 7

Do employees receive cybersecurity awareness training?

Staff should know how to identify phishing, fraud, and suspicious requests.

At least annually with periodic remindersOccasional informal trainingRarely or neverNot sure

Security Area 8

Does your organization use a password manager and unique passwords?

Reused passwords allow one breach to spread across multiple systems.

Yes, an approved business password managerSome employees use onePasswords are often reused or sharedNot sure

Security Area 9

Are administrator privileges limited?

Everyday users generally should not have unrestricted administrator access.

Yes, separate admin accounts are controlledMostly limitedMany users are local administratorsNot sure

Security Area 10

Is remote access provided through secure, managed methods?

Open ports and unmanaged remote-access tools can create serious risk.

VPN or approved managed access with MFAManaged remote access without MFAOpen ports or unmanaged toolsNo remote access / not applicable

Security Area 11

Are staff, guest, camera, and device networks separated?

Network segmentation limits exposure between different device types.

Yes, separated with VLANs or equivalent controlsSome separation existsEverything shares one networkNot sure

Security Area 12

Are laptops and portable devices encrypted?

Encryption protects data when a device is lost or stolen.

Yes, encryption is centrally verifiedSome devices are encryptedNo or not sure

Security Area 13

Has the organization reviewed cyber-insurance requirements?

Insurance applications increasingly ask detailed security questions.

Yes, requirements are documented and reviewedWe have a policy but have not reviewed controls recentlyNo policy or reviewNot sure

Security Area 14

Is there a written incident-response plan?

A clear plan reduces confusion during a security event.

Yes, documented and reviewedInformal plan onlyNo planNot sure

Security Area 15

Is third-party and vendor access reviewed and removed when no longer needed?

Old accounts and vendor access can remain unnoticed for years.

Yes, access is documented and reviewedReviewed occasionallyNo formal reviewNot sure

Security Area 16

Is Microsoft 365 or other cloud data backed up independently?

Cloud platforms provide availability, but independent backup adds recovery options.

Yes, independently backed upOnly limited native retentionNo independent backupNot sure

Security Area 17

Are all business computers running supported operating systems?

Unsupported systems stop receiving normal security updates.

Yes, all supportedA small number are outdatedSeveral unsupported systems remainNot sure

Security Area 18

Are security and system alerts reviewed by a responsible provider or employee?

Monitoring only helps when alerts are reviewed and acted upon.

Yes, alerts are reviewed consistentlyOnly critical issues are reviewedNo formal alert reviewNot sure

Security Area 19

Are employee accounts and access removed promptly when someone leaves?

Delayed offboarding can leave email, files, and systems exposed.

Yes, using a documented processUsually, but not formally documentedInconsistentlyNot sure

Security Area 20

Could the organization continue operating after a major outage or cyberattack?

Business continuity depends on technology, procedures, communication, and recovery planning.

Yes, recovery priorities and responsibilities are documentedSome recovery planning existsNo formal continuity planNot sure

0out of 100

Your Cyber Readiness

Your Assessment Results

Recommended next steps

Schedule a Professional Review

This educational self-assessment is not a formal cybersecurity audit, penetration test, compliance certification, insurance determination, or guarantee against loss. Results are based only on the answers provided and should be reviewed with a qualified technology or security professional.

Need Help Interpreting the Results?

Turn your score into a practical improvement plan.

Xpress Technologies can review your environment, validate important controls, and recommend realistic next steps based on your budget and business priorities.

Schedule an Assessment