You do not need a long audit to learn whether your security basics are in place. Eleven questions will find most of the common gaps. Here is what to check, and what a weak answer usually means.
1. Firewall age and firmware
Is the firewall still supported by its vendor, and is the firmware current? An end-of-life firewall stops receiving security fixes.
2. Multi-factor authentication
Is it required for email, remote access and administrator accounts? Stolen passwords are one of the most common ways in, and a second factor stops most of those attempts.
3. Endpoint protection and detection
Does every laptop and server run current endpoint protection, and does someone watch the alerts? Software that no one monitors only produces logs.
4. Backups, including an offline copy
A common guideline is three copies of your data, on two kinds of media, with one copy kept offline or immutable. The test is a restore, not a backup report.
5. Email security
Email is the most common delivery path for phishing and malware. Check for filtering beyond the default of your mail platform, and for protection against spoofed senders.
6. Patching
How quickly are operating system and application updates applied, and who owns the process? Know which systems are not patched and why.
7. Administrator rights
Who has them, and do they use the same account for daily work? Limit administrator rights to those who need them, and use separate accounts for administration.
8. Remote access and VPN
How do staff and vendors connect from outside? Check that remote access uses multi-factor authentication, that old accounts are removed, and that the VPN software is current.
9. Logging and monitoring
If something went wrong last week, could you tell? Central logs from firewalls, servers and identity systems make an investigation possible.
10. Incident response plan
Do you know who to call, who decides, and how to communicate if systems are down? A one-page plan that people have read is better than a long one that nobody has.
11. Compliance needs
Do customers, insurers or regulations require something specific, such as SOC 2, HIPAA or a state privacy law? Knowing the requirement early shapes every other decision.
How to use the list
Mark each area green, amber or red. Fix the red items first, and write down an owner and a date for every amber one. Repeat the check every six months, and after any major change to your network.
Common patterns we see
Watch for lopsided setups: a good firewall with weak recovery, or strong endpoint protection that no one monitors. Check that multi-factor authentication covers administrators and remote access as well as staff email, because those are the accounts attackers want most. Check that a restore has been tried recently, not only that a backup job reports success. Most of these gaps are inexpensive to fix once you know about them. The hard part is knowing.
Get a second pair of eyes
Our engineers will review your answers and reply with a short written summary of gaps and sensible next steps. It is free and carries no obligation.