HAI ConsultingSecure IT by design
Menu
ContactSearchClient portal
ConsultingAll servicesStarter engagementsIndustriesWork examples
Resource libraryExplore the libraryKnowledgeLearning pathsTemplatesSelf-checksOnline tools
About HAIAboutApproachTrust centreCommon questions
Self-checks

Check your security and recovery basics

Two short self-checks for small and midsize organizations. Answer each question honestly; the score is calculated in your browser and nothing you select is sent anywhere or stored.

A self-check is a conversation starter, not an assessment. It cannot confirm that any control works; only evidence from your own environment can do that.

Security basics self-checkRecovery readiness self-check
10 questions

Security basics self-check

Ten questions about identity, email, updates, access and monitoring.

  1. Is multi-factor authentication required for every user on email, remote access and cloud administration?

    Guide: Microsoft 365 security and administration

  2. Do administrators use separate administrative accounts, and is the list of privileged accounts reviewed regularly?

    Guide: Privileged access without losing the recovery path

  3. Do you have tested emergency (break-glass) access in case multi-factor authentication or the identity provider fails?

    Guide: Emergency access accounts: the control that stops MFA from locking you out

  4. Are updates applied on a regular schedule, with a faster route for vulnerabilities that are being actively exploited?

    Guide: Patch management for small businesses: a routine that holds

  5. Are SPF, DKIM and DMARC published for your email domains, and does someone read the DMARC reports?

    Guide: Deploy SPF, DKIM, DMARC, MTA-STS and BIMI without breaking mail

  6. Are requests to change payment or banking details confirmed by calling a known number, never by replying to the email?

    Guide: Business email compromise: stopping payment fraud

  7. Does every firewall rule have an owner and a business reason, and are the rules reviewed at least once a year?

    Guide: Firewall rule review: a checklist that produces defensible change

  8. Is vendor and third-party remote access named, time-limited and removed when the work ends?

    Guide: Third-party remote access: control the whole connection lifecycle

  9. Are security logs kept long enough to investigate an incident, and does a named person review alerts?

    Guide: Security logging coverage and retention: design for the investigation

  10. Are laptops and phones that hold company data managed, with encryption, a screen lock and the ability to wipe them remotely?

    Guide: Intune rollout: what to decide before you enrol devices

Turn on JavaScript to see a score. Without it, use the questions as a checklist: every answer other than yes is a place to start.

8 questions

Recovery readiness self-check

Eight questions about backups, restores and what happens on a bad day.

  1. Is there a current list of critical systems and data, each with a named owner?

    Guide: Recovery evidence: prove the service can come back

  2. Is at least one backup copy offline or immutable, and protected by credentials that are separate from everyday administration?

    Guide: Ransomware recovery readiness: a checklist you can prove

  3. Has a restore of an important system been tested recently, timed and written down?

    Guide: Service recovery test plan and evidence record

  4. Have business leaders agreed how long each critical service can be down and how much data it can lose?

    Guide: Recovery evidence: prove the service can come back

  5. Is Microsoft 365 or other cloud data covered by a backup, or is there a recorded decision not to back it up?

    Guide: Microsoft 365 backup: what native recovery will and won't restore

  6. Are incident contacts, decision makers and key phone numbers available somewhere that still works if email and file shares are down?

    Guide: Ransomware recovery readiness: a checklist you can prove

  7. Can you reach the backup console and administrative accounts if your normal sign-in service is unavailable?

    Guide: Emergency access accounts: the control that stops MFA from locking you out

  8. Do production changes have a rollback plan that is checked before the change window?

    Guide: Firewall change planning with a tested rollback

Turn on JavaScript to see a score. Without it, use the questions as a checklist: every answer other than yes is a place to start.

Free initial consultation

Want a second opinion?

Describe your environment and what the self-check showed. The first conversation is free, with no obligation to go further.

Contact HAI Consulting