Cyber health check · 5 minutes
How healthy is your cyber security?
Eighteen questions across seven areas, with feedback on each answer as you go. At the end you get a score, a breakdown by area, and your five priority fixes emailed to you as a short report.
Cyber health check
Seven short areas, 18 questions. You see what each answer means as you go, then your score and a breakdown by area. Your prioritised fixes are emailed to you as a short report.
- 1Accounts and access
- 2Devices and updates
- 3Backups and recovery
- 4Email, phishing and people
- 5Payments and fraud
- 6Cloud and data
- 7Being ready for an incident
What it covers
What the health check asks about
The check covers the controls behind most successful attacks on organisations: stolen logins, unpatched devices, ransomware, phishing and payment fraud. Many of them are also what Cyber Essentials and cyber insurers ask about.
- Accounts and access: multi-factor authentication, passwords and leavers.
- Devices and updates: patching speed, unsupported devices and endpoint alerts.
- Backups and recovery: automatic backups, a copy ransomware cannot reach, and restore testing.
- Email, phishing and people: reporting, awareness training and email spoofing protection.
- Payments and fraud: bank detail changes and urgent payment requests.
- Cloud and data: sharing permissions and unusual sign-ins.
- Being ready for an incident: a written plan and an offline contact list.
Your result
How the score works
The controls that stop the most common attacks (multi-factor authentication, patching, backups, phishing reporting, bank detail checks and an incident plan) count double. Your best answer scores in full, a partial answer scores half, and anything else scores nothing. If you have no backups, the backup follow-up questions are skipped and score nothing.
| Score | Result | What it usually means |
|---|---|---|
| 75% or more | Strong habits | Most of the basics are in place. Look at the remaining gaps before an attacker does. |
| 45% to 74% | Some clear gaps | Good foundations in places, with a few gaps that leave you open to common attacks. |
| Below 45% | Foundations first | Several core controls are missing. The first fixes are well understood and quick to put in place. |
Its limits
What a score does not tell you
This is a guide based only on your own answers. It is not an audit, a certificate or legal advice. Your score and area breakdown appear on screen without sharing any details. If you ask for the emailed report, we use your work email and phone number to send it and to offer a call about your results, as set out in our privacy notice.
For an independent view of your environment, book a 30-minute call with a senior advisor.