Cybersecurity Self-Assessment
Check the basic security controls a small team should have, such as sign-in, updates, backups, devices and staff awareness, and get the next steps for each gap.
- Free
- No sign-up to try
- Works as you type
Answer for your whole team, including laptops and phones used for work. This checks basic controls; it isn't an audit or a certification.
0 of 12 answered
Answer the questions to see your score by area as you go.
Answer at least 10 of 12 questions to save your results as a Room.
How it works
How the Cybersecurity Self-Assessment works
- 1
Answer the questions
Pick the answer closest to where you are today. It takes a few minutes.
- 2
See your score
Your score by area appears as you answer, with the weakest areas first.
- 3
Save your results
Create a Room with your scores, next steps and an adviser to talk them through.
Worked example
What it makes
12 questions across 4 areas. Each answer scores 0 to 3; an area's score is its points as a share of the most it could get.
Accounts and access
- How do staff sign in to work systems?
- How are passwords managed?
- What happens to access when someone leaves or changes role?
Devices and software
- How are software and devices kept up to date?
- Do you know every device and system that holds company data?
- Are laptops and phones protected if they're lost or stolen?
Data and backups
- How are important files and systems backed up?
- Do you know where sensitive data is kept?
People and response
- How are staff trained to spot phishing and scams?
- If something goes wrong, does everyone know what to do?
- How are suppliers who handle your data checked?
Results bands: Early (0+), Developing (40+), Established (70+), Leading (90+). A self-assessment from your own answers: a starting point for a conversation, not an audit, certification or professional advice.
Who it's for
Who uses it
Small business owners
Find the basic controls that are missing.
Office and IT managers
Prioritise security work with a short, clear list.
Managed service providers
Run a quick baseline with a new client.
Good to know
What to consider
- Covers basic controls only; it isn't an audit, penetration test or certification.
- If you handle sensitive data or customers ask for assurance, get an independent review.
Questions
About the Cybersecurity Self-Assessment
What should we fix first?
Usually multi-factor sign-in on email, automatic updates and tested backups. The result lists next steps for your weakest areas in order.
Is this an audit or a certification?
No. It scores your own answers against a written rubric to show where you stand and what to do next. Use it to start a conversation, not as an audit, certification or professional advice.
Make your results now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my resultsRelated
Related tools
- Security Review ChecklistMake a security review checklist for a new tool or vendor: what it touches, sign-in and access, data handling, vendor evidence and a recorded decision.
- Password Manager ComparisonCompare business password managers on shared vaults, admin and SSO, recovery when someone leaves and cost per user. You score each one; the Room keeps the decision on record.
- ISO 27001 Readiness CheckRun a gap check against elements commonly expected for ISO 27001, from scope and risk assessment to controls, internal audit and management review. Not a certification audit.