Call 01494 866668

    Small business cyber security self-assessment

    Review six parts of your business security with 20 plain-English questions. Get a score and five practical priorities, without needing to share your contact details.

    20 questions in six areas

    Choose the answer that best describes what is in place today. Choose “No / not sure” when you cannot confirm a control.

    Accounts
    Do all staff use a second sign-in step for email?

    A password alone is not enough. Check every active account.

    Are leavers' accounts closed the same day?

    Remove sign-in access promptly, while preserving records appropriately.

    Does more than one authorised person hold the admin access?

    Use protected individual or emergency accounts, not widely shared passwords.

    Are unusual account sign-ins checked outside office hours?

    Confirm who sees alerts and can act on them.

    Devices
    Do staff work without local administrator rights day to day?

    If someone routinely works as a local administrator, choose No.

    Are high-risk and critical security updates installed within 14 days?

    Check reports, including browsers and other installed software.

    Is protection active on every supported device?

    Check coverage, not just whether software was once installed.

    Do you know which devices hold business information?

    Include laptops, phones and equipment used away from the office.

    Email
    Is incoming email protected and suspicious mail reviewed?

    Check licence protection and any separate filtering arrangement.

    Are your sending domains protected by an enforced DMARC policy?

    A policy of none only requests monitoring, not rejection.

    Are bank-detail changes verified through a known telephone number?

    Do not use the contact number supplied in the suspicious message.

    Backup
    Is Microsoft 365 data backed up independently of Microsoft?

    Retention and synchronisation are not the same as independent backup.

    Have you restored a file from backup in the last year?

    A successful job is not the same as a checked, usable restore.

    Are backup schedules matched to how much work you can redo?

    Agree a recovery point target rather than assuming daily is enough.

    People
    Do staff receive regular phishing-awareness training?

    Include new starters and learning from previous attempts.

    Do staff know how to report a suspicious email quickly?

    Make the route easy to find without blame or embarrassment.

    Does everyone use unique passwords and a password manager?

    Avoid reusing passwords between work and personal accounts.

    Planning
    Do you have a written cyber incident plan?

    Record who makes decisions, who to call and how to preserve evidence.

    Is the domain name registered to the business?

    Check registrar access, renewal notices and the authorised owner.

    Have you tested a way to work when your main cloud service is down?

    Include staff communication, files, email and decision authority.

    How to read your result

    The score weights the 20 questions equally. The five priorities are ranked by the reported gap and practical impact, with related services and published starting prices. A high self-reported score is not proof that controls work. Download your result as a PDF without giving us an email address.

    Questions about this service

    Do I need to give contact details?

    No. The full result appears on this page. Any supported PDF or Word download is also free without contact details. The report email form is optional and appears after the result.

    What happens to my entries?

    Calculations and worksheets run in your browser without saving entries to our server. The domain checker sends your domain to our server and a public DNS resolver. The password checker sends only a five-character hash prefix directly to the range service. If you explicitly request an email, your full report is emailed to you; your contact details, tool name and result summary go to support@cloudss.co.uk.

    Is the result a guarantee or a quote?

    No. Use it as a starting point for a practical review. Recommendations depend on what you enter, and any service scope, licence or price is confirmed in writing.

    Keep control of your information

    Do not enter passwords, recovery codes or confidential customer records into a worksheet. The dedicated password check is the only tool designed to process a password, entirely in your browser. You can refresh the page to clear entries.

    Related information

    Talk to us about your business

    Call 01494 866668

    Prefer us to contact you? Request a call back.

    CallEnquire