Where do you actually stand?

1. Multi-factor authentication is required for email and core business applications.

2. Access to systems is granted through documented approval, and removed on or before an employee's last day.

3. Someone formally reviews who has access to what at least quarterly, with the review recorded.

4. Written security policies — access control, acceptable use, incident response — exist and are approved by management.

5. Security responsibilities are assigned to named people, not left to “everyone.”

6. A written risk assessment exists and is reviewed at least annually by leadership.

7. Security patches are applied on a defined schedule, with exceptions tracked and justified.

8. Changes to production systems are approved, tested, and reversible — with a documented rollback plan.

9. Backups run automatically, and a restore has actually been tested within the last year.

10. Logs from critical systems are collected centrally and kept for a defined retention period.

11. An incident response plan exists, names specific roles, and has been exercised — tabletop or real — in the last year.

12. Critical vendors are security-reviewed before onboarding and reassessed at least annually.

13. Physical access to offices and server areas is badge-controlled, logged, and periodically reviewed.

14. All employees complete security awareness training at least annually.