You want to know how secure your organisation is, but where do you start? This checklist from The Digital Compass helps you assess where you stand in a few minutes. Go through the questions and tick every one you can answer with a wholehearted yes.
Step 1: login details and online identity
- Does everyone use two-step verification (2FA) for email, accounting and other important systems?
- Are passwords stored in a password manager, and not in the browser or a spreadsheet?
- Are business and personal accounts separated, so nobody uses work accounts on unprotected personal devices?
- Is access to systems revoked immediately when someone leaves?
Step 2: backups and recovery
- Are important data backed up automatically every day?
- Is there at least one offline backup that is not connected to the network?
- Are the backups encrypted, so unauthorised people cannot access them?
- Are the backups tested regularly by restoring files?
Step 3: updates and patch management
- Are operating systems, software and devices updated automatically?
- Has all outdated software that no longer gets updates been replaced or switched off?
- Are all devices and accounts mapped, so there are no unprotected systems lying around?
Step 4: email security and reputation
- Are SPF, DKIM and DMARC set up to prevent misuse of your domain?
- Are incoming emails automatically checked for suspicious attachments and links?
- Is unwanted email caught before it reaches the inbox?
- Are employees trained to recognise phishing, CEO fraud and invoice fraud?
Step 5: behaviour and awareness
- Is cybersecurity a fixed part of the whole organisation, with management visibly setting the example?
- Do employees dare to report suspicious situations without fear of consequences?
- Are security exercises held regularly?
- Do security agreements also apply to suppliers and external parties?
Count your ticks
- 15 to 19 ticks: your organisation is well protected. Stay alert and keep cybersecurity a fixed part of how you run things.
- 10 to 14 ticks: you have a solid basis, but there are weak spots that need attention. Time to take action.
- 0 to 9 ticks: there are serious risks. Criminals have little trouble getting in. Take action straight away.
What now?
Cybersecurity is not a checklist you tick off once, but a mindset. Start small, but start today. Even simple steps, such as two-step verification and better password management, make a big difference. Which measures pay off most, you can read in 5 actions that really work.
Want a fuller picture, with an explanation per topic and your first steps listed? Then take the free Cybercheck. If you are unsure about the outcome, or want someone to take an independent look, a baseline assessment is the next step.
More in The Digital Compass
This checklist comes from the first edition of The Digital Compass (in Dutch), with an explanation of the why behind each topic.
