How exposed is your business to a cyber attack?

Your answer:

Why it matters

An untested backup is a guess. The distance between "we have backups" and "we had the server back in four hours" is where a bad week becomes a bad quarter, and it only ever reveals itself on the day you need it.

What to do about it

Automate the backups, keep one copy offline or immutable so ransomware can't reach it, and book a real restore test. Restore an actual file and an actual server, then write down how long each took — that number is your true recovery time.

Your answer:

Why it matters

Stolen passwords are bought in bulk and are the cheapest way into a business. MFA is the one control that turns a working password into a useless one — and "optional MFA" means the people most likely to be targeted are precisely the ones who opted out.

What to do about it

Enforce MFA by policy rather than by request, starting with email, remote access and anything touching money. Prefer an authenticator app or hardware key over SMS, and read the exception list carefully — that is where the exposure hides.

Your answer:

Why it matters

Modern ransomware does not trip a scanner and politely stop. It moves, escalates and waits. Detection only helps if a human sees it — software that raises an alert at 2am into an empty inbox has bought you nothing.

What to do about it

Standardize on one managed endpoint product across every machine, including the ones that "don't matter". Make sure alerts reach a person who is paid to act on them, and confirm servers are covered too, not just laptops.

Your answer:

Why it matters

Admin rights decide how far an intruder gets after the first mistake. If daily work happens in an admin account, one bad click inherits control of the whole environment — and shared logins mean you cannot tell afterwards who did what.

What to do about it

Give administrators two accounts: an ordinary one for email and browsing, and a separate one for admin work with MFA on it. Retire shared logins, then diary a quarterly review of who still needs the rights they were handed.

Your answer:

Why it matters

Attacks are timed for when nobody is looking. Long weekends and overnight are prime windows precisely because the response is hours away. The number that matters is not whether alerts exist — it is how long a genuine one sits unopened.

What to do about it

Get monitoring that covers evenings and weekends with a named escalation path, and tune out the noise so real alerts stand out. If alerts currently land in a shared mailbox, start there.

Your answer:

Why it matters

A large share of successful intrusions use a flaw that was patched long before it was exploited. "Automatic updates are on" is one of the most common false assurances in IT — machines fail to apply them silently, and the failure only becomes visible once somebody takes advantage of it.

What to do about it

Manage patching centrally and, more importantly, report on compliance: which machines are behind, and by how long. Include third-party software — browsers, PDF readers, and the line-of-business app nobody wants to touch.

Your answer:

Why it matters

Without an enforcing DMARC policy, anyone can send invoices and payment-change requests that appear to come from your domain — to your own customers. The damage lands on your reputation, and you usually hear about it from the client who already paid.

What to do about it

Publish SPF, DKIM and DMARC, then move DMARC from p=none to quarantine and finally to reject once the reports come back clean. It is a DNS change rather than a purchase; the work is in reading the reports, not writing the record.

Your answer:

Why it matters

Microsoft 365 ships convenient, not hardened. Legacy authentication protocols in particular walk straight past MFA — so a tenant can have MFA "enforced" and still be opened with a password alone.

What to do about it

Block legacy authentication, put conditional access around risky sign-ins and unmanaged devices, and read what your tenant's secure score is actually telling you. Then diary a review, because settings drift every time licensing changes.

Your answer:

Why it matters

Access outlives employment far more often than anyone expects. It is rarely malicious — but a dormant account with a known password and no MFA is an unmonitored door, and it will not come up in any offboarding conversation you have already had.

What to do about it

Write the checklist once and cover every system, not just email: VPN, remote tools, SaaS apps, shared logins, building access. Make the final step a verification by someone other than the person who did the work.

Your answer:

Why it matters

Your security is only as good as the least careful company you handed a key to. Standing vendor access is a favorite route in precisely because it sits outside your monitoring and nobody remembers granting it.

What to do about it

List every party with remote access and what each one actually needs. Replace permanent accounts with time-boxed, MFA-protected access, and revoke anything nobody can justify in a single sentence.

Your answer:

Why it matters

Microsoft and Google guarantee their service is available, not that your data is recoverable. Retention windows are short and their responsibility ends at the platform — a deleted mailbox, an encrypted SharePoint library or a departed employee's OneDrive can pass the point of no return in weeks.

What to do about it

Back Microsoft 365 or Workspace up to a separate provider with its own retention, covering mail, OneDrive, SharePoint and Teams. Then restore a single mailbox as a test, because that is the scenario you will actually use.

Your answer:

Why it matters

Phishing is still the most common way in, and it targets judgement rather than software. Training once at onboarding is a policy record, not a defence — the tactics change monthly and confidence fades fast.

What to do about it

Run short, regular training with simulated phishing so you can watch the trend rather than guess at it. Treat clicks as data rather than discipline; the goal is people who report a suspicious email quickly, not people afraid to admit a mistake.

Your answer:

Why it matters

The first two hours decide the cost. Without a plan that time goes on working out who is in charge, who to notify and whether to pull systems offline — while the incident carries on. Plans that have never been read aloud tend to fail on the details.

What to do about it

Write down who leads, who calls whom (including your insurer and legal counsel), how you would operate for a day without core systems, and where the plan lives when email is down. Then walk it through once a year — an hour around a table finds most of the gaps.

Your answer:

Why it matters

A lost laptop is a hardware problem if the disk is encrypted and a privacy breach if it is not — and under PIPEDA a breach of security safeguards posing a real risk of significant harm has to be reported. Encryption is what keeps the incident boring.

What to do about it

Turn on BitLocker or FileVault everywhere and, critically, escrow the recovery keys centrally. Enroll the phones that touch company mail so you can wipe company data without wiping somebody's family photos.

Your answer:

Why it matters

Almost everything on this page is recurring maintenance rather than a one-time purchase. Break-fix support is paid to repair what already failed, which means nobody is paid to notice the slow drift beforehand — and drift is exactly what these questions measure.

What to do about it

Name who is accountable for the recurring work: patch reporting, restore tests, access reviews, offboarding. Put it in writing with a frequency attached. That is the difference between having controls and having had them.

Your answer:

Why it matters

Cyber insurance applications ask whether you enforce MFA, hold offline backups and patch on a schedule — and a claim can be reduced or refused when those answers turn out to have been optimistic. PIPEDA already requires Canadian businesses to log breaches and report the serious ones, and Bill C-8 raises the bar again for businesses connected to critical services.

What to do about it

Pull out last year's insurance application and check each answer against reality. Keep a short, current record of your controls and your breach log — it is the same document a client's security questionnaire will ask you for.