How exposed is your business?

Do all staff use two-step verification on email, banking and key business accounts?

A code from an app or text message as well as the password.

Does everyone use their own unique passwords (or a password manager), with no shared logins?

No one password reused across accounts, no shared “office” logins.

Is your important business data backed up automatically, at least every week?

Customer records, accounts, invoices, documents, website.

Is one backup kept separately, and have you tested restoring from it?

Offline, or in a separate account an attacker couldn’t reach.

Are computers and phones set to install security updates automatically?

Windows, macOS, Android, iOS, browsers and key apps.

Do all work devices have a screen lock and antivirus or built-in protection switched on?

PIN or password lock, Windows Defender / Mac protection, device encryption.

Have staff been shown how to spot phishing emails, fake payment requests and scam calls in the last year?

Including fake “bank” calls, SIM-swap tricks and urgent messages from the “boss”.

Do you confirm any change of bank details or urgent payment request by phone before paying?

Calling a number you already have — not one in the email.

When someone leaves, are their accounts and access removed the same day?

Email, shared drives, banking, social media, apps.

Do staff only have access to the systems and data they need for their job?

No shared admin accounts; admin rights only for those who need them.

Is your office Wi-Fi password-protected, with a separate network for guests?

WPA2 or WPA3, and the router’s default admin password changed.

Do you know exactly who to call and what to do first if you’re hacked or lose data?

A short written plan: who decides, who to call, what to switch off.