Can Your Business Pass a Cybersecurity Assessment?
A Self-Administered Cybersecurity Checkup for Small & Mid-Sized Businesses
Cybersecurity is no longer just an “IT issue.” For today’s small and mid-sized businesses, it is a business survival issue. Cyberattacks continue to target organizations of every size, and many SMBs are hit simply because hackers know smaller businesses often lack the protections of larger enterprises.
The good news is that improving your cybersecurity posture does not always require a massive budget or a full-time internal security team. It starts with understanding where your business stands today.
This self-administered cybersecurity assessment is designed to help business owners, managers, and decision-makers identify strengths, weaknesses, and gaps in their organization’s cybersecurity practices. Whether you are a medical office, law firm, construction company, manufacturer, financial office, or retail business, these questions can help you evaluate your current level of protection.
Cybersecurity Assessment Levels
This assessment is broken into three categories:
- Basic Requirements – Foundational protections every business should have
- Intermediate Requirements – Enhanced security and operational safeguards
- Advanced Requirements – Mature cybersecurity and compliance-focused protections
The more “Yes” answers you have, the stronger your cybersecurity readiness likely is.
Basic Cybersecurity Requirements
Every SMB Should Be Able to Answer “Yes”
1. Do all company computers use modern antivirus or endpoint protection software?
Basic antivirus is no longer enough. Businesses should use actively managed endpoint protection capable of detecting ransomware, malware, and suspicious behavior.
2. Are your operating systems and software regularly updated?
Outdated software is one of the most common ways cybercriminals gain access to business networks.
3. Do employees use strong passwords?
Passwords should be complex, unique, and never reused across multiple systems.
4. Is Multi-Factor Authentication (MFA) enabled for email and critical systems?
MFA dramatically reduces the risk of unauthorized access even if passwords are stolen.
5. Is your business data backed up regularly?
Backups should be automated, monitored, and tested regularly.
6. Are your backups protected from ransomware?
If backups remain connected to the network at all times, ransomware can often encrypt them too.
7. Do employees receive cybersecurity awareness training?
Many cyberattacks begin with phishing emails targeting employees.
8. Is your wireless network secured with modern encryption?
Guest WiFi should also be separated from your business network.
9. Do former employees lose access immediately when they leave?
User accounts should be disabled immediately after termination.
10. Do you know who to call if your business experiences a cyberattack?
Every business should have a cybersecurity response plan and trusted IT professionals available.
Basic Assessment Scoring
- 8–10 Yes Answers: Good foundational protection
- 5–7 Yes Answers: Moderate risk exposure
- 0–4 Yes Answers: High cybersecurity risk
Intermediate Cybersecurity Requirements
Security Practices Growing Businesses Should Implement
1. Are your firewalls actively monitored and managed?
Modern firewalls require ongoing updates, monitoring, and security rule management.
2. Is email filtering in place to block phishing and malicious attachments?
Email remains the #1 delivery method for ransomware and fraud attempts.
3. Are company laptops encrypted?
Encryption helps protect sensitive business data if a device is lost or stolen.
4. Do you have remote monitoring and alerting for servers and workstations?
Proactive monitoring can detect issues before they become major problems.
5. Are administrative privileges restricted?
Employees should only have access to what they need to perform their jobs.
6. Do you regularly test your backups for recovery?
A backup is only valuable if it can actually be restored successfully.
7. Is sensitive business or customer data protected by access controls?
Not every employee should have access to financial records, HR files, or customer databases.
8. Do you maintain cybersecurity policies for employees?
Policies should cover password use, remote work, acceptable use, and security procedures.
9. Are cybersecurity risks reviewed with company leadership regularly?
Cybersecurity should be discussed at the management level, not only within IT.
10. Does your business use secure remote access tools?
Remote work solutions should be encrypted and protected with MFA.
Intermediate Assessment Scoring
- 8–10 Yes Answers: Strong cybersecurity maturity
- 5–7 Yes Answers: Some important protections missing
- 0–4 Yes Answers: Significant operational risk
Advanced Cybersecurity Requirements
Mature Security Standards for Modern SMBs
1. Do you conduct regular vulnerability scans?
Scanning helps identify weaknesses before cybercriminals find them.
2. Is dark web monitoring in place for employee credentials?
Compromised passwords often appear on the dark web long before businesses realize they were exposed.
3. Do you use advanced endpoint detection and response (EDR)?
EDR solutions provide behavioral monitoring and rapid threat response capabilities.
4. Is your business aligned with compliance or cybersecurity frameworks?
Examples may include HIPAA, PCI-DSS, NIST, FTC Safeguards Rule, or Cyber Insurance requirements.
5. Do you have cyber liability insurance?
Many businesses now require cybersecurity controls to qualify for coverage.
6. Is security logging actively reviewed and monitored?
Threats are often identified through unusual login activity or system behavior.
7. Are penetration tests or third-party security assessments performed?
External reviews often uncover overlooked vulnerabilities.
8. Is your network segmented?
Separating critical systems can limit the spread of ransomware or unauthorized access.
9. Do you maintain an incident response and disaster recovery plan?
Businesses should know exactly what steps to take during a cyber event.
10. Do you have a trusted Managed IT & Cybersecurity partner?
Technology changes rapidly. Many SMBs rely on experienced professionals to help manage and secure their environments.
Advanced Assessment Scoring
- 8–10 Yes Answers: Excellent cybersecurity readiness
- 5–7 Yes Answers: Good protection but improvement opportunities exist
- 0–4 Yes Answers: Elevated risk exposure and potential compliance concerns
Can Your Business Pass?
Cybersecurity is not about perfection. It is about reducing risk, improving resilience, and protecting your business operations, employees, customers, and reputation.
Many SMBs discover they are stronger in some areas than others. That is normal. The important part is identifying gaps before a cybercriminal does.
If your organization struggled with portions of this assessment, now may be the ideal time to review your cybersecurity strategy, backup systems, employee training, network security, and overall IT management approach.
At JK Consulting / JK Technology Solutions, we help businesses throughout Lockport, Joliet, Naperville, Fort Myers, Bonita Springs, and surrounding areas strengthen their cybersecurity posture with managed IT services, proactive monitoring, employee security training, backup solutions, firewall management, and advanced cybersecurity protection.
The question is not whether cyber threats exist. The question is whether your business is prepared to handle them.