Security Posture
Self-Assessment

Eight questions on the protections a DNS scan can't see from the outside. Answer honestly. Nothing here leaves your browser.

1. 01Is multi-factor authentication (MFA) enforced for all users?Especially email, VPN, and admin consoles.

   Yes — enforced everywhere, phishing-resistant where possibleOn email/admin, but not every systemOptional / only a few users have itNo MFA in place
2. 02Does the team use a managed password manager?A shared, audited vault beats reused or spreadsheet-stored passwords.

   Yes — company-wide, enforcedSome people do, informallyNo — passwords are reused or stored ad hoc
3. 03How often is privileged / admin access reviewed?Stale admin accounts are a top breach vector.

   Quarterly or more often, documentedAbout once a yearNever / not tracked
4. 04Do endpoints run managed detection & response (EDR/MDR)?Beyond consumer antivirus — monitored, with response capability.

   Yes — EDR with 24/7 monitored response (MDR)EDR deployed, but self-monitoredOnly built-in / consumer antivirusNothing in particular
5. 05What is your patch / update cadence?Unpatched systems are the most common ransomware entry point.

   Centrally managed, automatic within daysManual, roughly monthlyOnly when something breaks
6. 06Do you have tested backups following 3-2-1?3 copies, 2 media, 1 offsite — and restores actually verified.

   Yes — 3-2-1 with periodic restore testsBackups exist but restores are never testedSome ad-hoc backups onlyNo reliable backups
7. 07Is there a written incident-response plan?Who to call, what to do, in what order — before an incident.

   Yes — written and rehearsedWritten but never exercisedNo plan
8. 08Do staff get regular security-awareness training?Including phishing simulations.

   Yes — ongoing, with phishing testsOnce a year / at onboardingNo formal training