How secure is your business IT?

Question 1 of 10

Which devices do your staff use to access company data?

Question 2 of 10

Do you enforce any policies on end user devices where company data is stored?

Devices may include laptops, desktops, tablets and mobile phones. Policies would normally include as a minimum, requirements for encryption, anti-virus, up to date operating system and secure login.

Question 3 of 10

Does your business deal with sensitive confidential data?

Sensitive personal data as defined under GDPR legislation includes: sexual orientation, race, biometric data (etc). This is normally personal data that is not already in the public domain, and may do harm to the individual if it was released.

Question 4 of 10

Do you enforce Multi Factor Authentication before your company data and systems can be accessed?

Multi factor authentication, also known as two factor authentication, requires a second level of security before login is allowed, commonly this is a code or notification to the user's phone in addition to their password.

Question 5 of 10

Do you have automatic daily backups of all your data, including those from trusted third party suppliers like Microsoft?

Backups only qualify if they are automated (i.e. require no human intervention), are daily and are stored in a separate geographical location to the source data

Question 6 of 10

Does your business have inbound email protection in place to ensure malicious emails do not reach staff?

Email protection should include the scanning of all inbound and ideally, outbound emails. It should include functionality to check included links and attachments.

Question 7 of 10

Do your teams have clear guidance on what is and what is not acceptable in regards to their use, storage and sharing of company data, systems and devices?

This should include induction training, refresher training and documented policies which are accessible to staff.

Question 8 of 10

Does your business filter internet content?

Website filtering is often used to prevent access to malicious sites or certain categories of content.

Question 9 of 10

Is all your company data encrypted at rest, whatever device it's on? Do your staff have the ability to encrypt data before sharing it outside the business?

Encryption of data means it is not readable without the proper keys. Where possible data should be encrypted when not in use, on all devices. When data is sent via email or put on portable storage, it must always be encrypted first. Staff should be aware of this and know how to do this.

Question 10 of 10

Are all your IT systems and servers managed and monitored? Do they have monthly patching? Are old systems decommissioned?

IT requires house keeping, this includes installing security updates and monitoring them for unusual behaviour.