Cybersecurity Maturity Audit

Do you use a "Tiering Model" for Admin accounts?

Do administrators use the same account for browsing the web and administering servers? (Extremely risky — Admin accounts must be used EXCLUSIVELY on servers).

Is Patch Management automated and audited?

Are critical (Zero-Day) vulnerabilities patched automatically in < 24h, or do you rely on manual "when we remember" updates?

Do you have anti "Shadow IT" policies?

Do employees store company data on personal Dropbox/Google Drive accounts without IT approval? Do you have visibility into this?

Do you use DLP (Data Loss Prevention)?

If an employee tries to copy the client database to a USB stick or send it to a personal email, does the system block the transfer?

Are mobile devices managed via MDM?

If an employee loses their work phone (with company email), can you wipe data remotely (Remote Wipe) instantly?

Do you have "Application Whitelisting" active?

On company computers, can only IT-approved programmes run, or can employees install anything (including games or pirated software)?

Do you have EDR/XDR instead of classic antivirus?

Classic antivirus only sees files. An EDR (Endpoint Detection & Response) sees behaviours: "Why did Excel launch PowerShell at 3am?". This is the current minimum standard.

Do you have a SOC service or 24/7 monitoring?

Hackers attack on Friday nights. Does someone monitor critical alerts during the weekend and holidays, or do you wait until Monday morning?

Do you run monthly vulnerability scans?

Do you automatically scan the network to find outdated equipment or accidentally open ports before hackers find them?

Do you know your RTO/RPO?

Do you know exactly how long data recovery takes? (e.g. "We can be operational in 4 hours with max 1 hour of data loss"). Most firms just guess.

Is the backup IMMUTABLE (WORM)?

Modern ransomware deletes backups first. An immutable backup is locked from writing/deletion for X days, guaranteeing recovery without paying the ransom.

Do you use Sandboxing for attachments (ATP)?

Does the email system open attachments in an isolated virtual environment to see if they "explode" before reaching the user?

Do you have Conditional Access?

Does the system automatically block logins from unauthorised countries (e.g. China, Russia) or unknown devices, even if the password is correct?

Do you monitor data leaks (Dark Web)?

Do you know if your employees' passwords are already for sale on the Dark Web (from LinkedIn, Adobe breaches, etc.)?

Have you done a Penetration Test (PenTest) recently?

Has an "ethical hacker" tried, with authorisation, to break into your website or network to demonstrate the real vulnerabilities?

Do you have an Incident Response Plan (IRP)?

If attacked now, do employees know exactly who to call, who decides to shut down servers, and how to legally communicate with authorities?

Do you have cyber insurance?

Do you have a policy covering data recovery costs, legal proceedings and business interruption in case of attack?