Business self-check · about 4 to 6 minutes

Small business security

Start with accounts, devices, information and recovery. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original screening prompts for a small organization. Not a CIS audit, an insurance eligibility decision or a measure of attack coverage. Reference: NIST small-business resources (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Accounts

Does each person have a separate work account?
Is strong multifactor authentication used on important accounts?
Are passwords unique and stored in an approved password manager?

Devices

Are work devices and software inventoried?
Are supported systems updated within an agreed timeframe?
Are lost devices protected and removable from work access?

Information

Can staff recognize and report suspicious messages?
Is sensitive information shared only with intended people?
Are supplier and former-worker accounts reviewed?

Recovery

Are important records backed up independently of the primary account?
Has someone successfully restored an important record?
Does everyone know who to contact during a suspected incident?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Small business security assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · AI & agent security · SOC & incident readiness · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness