Answer each question for your organisation as it is today. Nothing you enter here leaves your browser: the result is calculated on this page and is not stored or sent anywhere.

This self-check is a general guide only. It is not an underwriting assessment, a quote or advice, and it does not mean cover will or won't be offered.
IdentityIs multi-factor authentication (MFA) enforced for every user's email account?
IdentityIs MFA enforced for remote access (VPN, remote desktop, remote support tools)?
IdentityDo administrators use separate admin accounts, protected by MFA, that aren't used for email or browsing?
RecoveryDo you keep backups that are offline or immutable, so ransomware can't delete or encrypt them?
RecoveryHave you successfully restored a critical system from backup in the last 12 months?
EndpointsDo servers and laptops run endpoint detection and response (EDR), not just basic antivirus?
EndpointsAre security updates applied to internet-facing systems within 14 days, or faster for critical issues?
ExposureIs remote desktop (RDP) closed to the internet, with remote access only through a secured gateway?
EmailIs DMARC set to quarantine or reject for your email domain(s)?
PaymentsAre changes to supplier or employee banking details verified by phoning a known number, not the number in the email?
PeopleHave staff had phishing awareness training in the last 12 months?
ResponseDo you have a written incident response plan that names who to call, including your insurer's hotline?

Want an expert view? A Cyber Risk Check adds an external review of your attack surface and a conversation with an underwriter.

Get a Cyber Risk Check