Is your business at the security baseline?
The US has no Cyber Essentials — but insurers, banks and bigger customers all ask about the same ground. This free check walks through the first tier of the CIS Critical Security Controls (Implementation Group 1), in plain English, and checks what it can against your website. About ten minutes. No login, and we don't store your answers.
CIS Controls v8.1 IG1 · baseline 2026.1. A readiness / gap report — not a CIS assessment or certification, and not legal advice.
Wondering which privacy laws apply to you? Check whether California's CCPA covers your business → (two minutes)
Know what you have
You can't protect a laptop nobody knows about. A list of your devices, your software and cloud services, and the outside companies that hold your data.
Do you keep an up-to-date list of every device that connects to your business — computers, phones, servers, routers?
A spreadsheet is fine. The point is that a lost laptop, or a device nobody updates, gets noticed.
The detail (dig in)
An asset inventory is the foundation the rest of the baseline assumes: you can't patch, encrypt or wipe a device you don't know exists, and unknown devices are where unpatched software hides. Review it at least twice a year and decide what happens to anything that shouldn't be there. Maps to CIS Safeguards 1.1 and 1.2 (IG1).
Do you keep a list of the software and cloud services you use — and of the outside companies that hold your data or run your IT?
Your accounting app, email, website host, point-of-sale, payroll, your IT provider. Anything nobody can explain should go.
The detail (dig in)
A software and service inventory lets you remove what's unauthorized or unused, and a service-provider inventory tells you who to call — and who to question — when one of them is breached. Supply-chain compromises reach small businesses through exactly these providers. Maps to CIS Safeguards 2.1, 2.3 and 15.1 (IG1).
Is all your software still supported by its maker — no operating systems or programs past their end-of-life date?
Software past its support date gets no security fixes, ever. An old Windows PC running the till is the classic example.
Must-have — a "No" here outweighs everything else on the page.
The detail (dig in)
Unsupported software is a permanent, unfixable vulnerability; insurers commonly decline cover while it's in use, which is why it's on the must-have list here. If something can't be replaced yet, it should be isolated from the internet and documented as an exception. Maps to CIS Safeguard 2.2 (IG1).
Accounts and access
Who can log in to what. Multi-factor authentication on email, remote access and admin accounts is the single control insurers weigh most.
Is multi-factor authentication (MFA) on for email, for any remote access, and for every administrator account?
MFA is the second step after a password — an app prompt or a code. Stolen passwords are the most common way in; MFA stops most of them.
Must-have — a "No" here outweighs everything else on the page.
The detail (dig in)
Credential theft and password reuse are the dominant ways attackers get in, and MFA on externally-exposed applications (email, cloud apps), remote network access and administrative access closes most of that route. App-based or hardware keys beat SMS codes. Carriers near-universally require it on the application. Maps to CIS Safeguards 6.3, 6.4 and 6.5 (IG1).
Does everyone have their own account with a unique password, and does nobody use an administrator account for everyday work?
No shared logins. Admin rights only for the job that needs them, on a separate account.
The detail (dig in)
Shared accounts make it impossible to tell who did what, and everyday browsing and email on an admin account means one malicious attachment gets full control of the machine. Unique passwords (a password manager makes this practical) stop one breach unlocking everything. Maps to CIS Safeguards 5.2 and 5.4 (IG1).
When someone leaves, or an account stops being used, is it switched off promptly?
Former staff and old contractor accounts are open doors nobody is watching.
The detail (dig in)
An inventory of accounts, a defined process for granting and revoking access, and disabling dormant accounts (CIS suggests after 45 days of inactivity) remove the accounts attackers prefer: valid, forgotten and unmonitored. Maps to CIS Safeguards 5.1, 5.3, 6.1 and 6.2 (IG1).
Secure configuration
Default passwords changed, firewalls closed except where needed, screens that lock — and a website that uses modern encryption. Part of this our scan can check.
Have the default passwords on routers, devices and software been changed, and default accounts disabled?
'admin/admin' on a router or camera is published in the manual — and in attackers' scripts.
The detail (dig in)
Default credentials are publicly documented and tried automatically by internet-wide scanners. A documented secure-configuration process — change defaults, disable what you don't use — is the IG1 expectation for every device and application. Maps to CIS Safeguards 4.1 and 4.7 (IG1).
Do firewalls on your network, servers and computers block incoming connections except the ones you actually need?
Remote desktop, databases and file-sharing should never answer to the whole internet. Our exposure check shows what does.
The detail (dig in)
Host-based firewalls (or port filtering) on servers and end-user devices, with a default-deny rule for inbound traffic, keep services like RDP, SSH and databases off the open internet — exposed RDP is one of the most common ransomware entry points. An in-depth scan that finds such a service contradicts a 'yes' here. Maps to CIS Safeguards 4.4 and 4.5 (IG1).
Do computers and phones lock themselves automatically after a few minutes without use?
A screen lock after 15 minutes on computers, 2 on phones, is the usual expectation.
The detail (dig in)
Automatic session locking limits what an unattended or lost device gives away. CIS's own guidance is no more than 15 minutes for general-purpose operating systems and 2 minutes for mobile devices. Maps to CIS Safeguard 4.3 (IG1).
Do your website and anything you log into over the web use HTTPS, with old encryption versions switched off?
Every page over HTTPS, a valid certificate, and the outdated TLS 1.0 and 1.1 turned off. Our scan checks this for you.
The detail (dig in)
Managing systems and serving users over secure protocols — HTTPS with TLS 1.2/1.3, legacy TLS 1.0/1.1 disabled, a trusted certificate, HSTS — is part of configuring web-facing assets securely. Our passive scan reads exactly this, so a website that still accepts legacy TLS contradicts a 'yes' here. Maps to CIS Safeguards 4.1 and 4.6 (IG1); encryption of data in transit is Safeguard 3.10, its IG2 neighbor.
Updates and vulnerabilities
Software kept up to date automatically, and a routine for fixing known security holes before attackers use them.
Are automatic updates on for operating systems, web browsers, and the software you use — including your router?
Let updates install themselves. Routers and Wi-Fi equipment need updates too, and are often forgotten.
The detail (dig in)
Automated operating-system and application patch management, only supported browsers and email clients, and network equipment kept on current firmware remove most known vulnerabilities without anyone having to remember. Maps to CIS Safeguards 7.3, 7.4, 9.1 and 12.1 (IG1).
Do you have a routine for fixing known security holes — so nothing on your website or servers stays unpatched for more than a month?
A short written process: who checks, how often, and what gets fixed first. Monthly is the baseline.
The detail (dig in)
A documented vulnerability-management process and a remediation routine reviewed monthly or more often is the IG1 expectation. Internet-facing services running software with known, exploitable vulnerabilities fall below it — our in-depth scan fingerprints those services, so a detected CVE contradicts a 'yes'. Maps to CIS Safeguards 7.1 and 7.2 (IG1).
Malware and email defenses
Anti-malware on every computer, known-bad websites blocked, and a domain criminals can't send email from.
Does every computer run anti-malware that updates itself?
Built-in protection (such as Microsoft Defender) counts, as long as it's on, updating, and on every machine.
The detail (dig in)
Anti-malware deployed and centrally visible across end-user devices and servers, with signature updates automatic and autorun/autoplay disabled for removable media, is the IG1 malware baseline. Many carriers now also ask about EDR (endpoint detection and response), which goes beyond it. Maps to CIS Safeguards 10.1, 10.2 and 10.3 (IG1).
Do you block known-malicious websites at the network level — for example with a filtering DNS service?
A filtering DNS service stops devices reaching known phishing and malware sites. Several are free and take minutes to set up on a router.
The detail (dig in)
DNS filtering resolves requests through a service that refuses known-malicious domains, protecting every device on the network — including ones that can't run anti-malware — from phishing pages and malware callbacks. Maps to CIS Safeguard 9.2 (IG1).
Is your domain protected against email spoofing — SPF published, and DMARC set to quarantine or reject?
Without this, criminals can send email that looks exactly like it's from you — how most invoice and wire fraud begins. Our scan checks it for you. (This one goes beyond IG1.)
The detail (dig in)
SPF lists who may send for your domain; DMARC tells receivers what to do when a message fails — and only p=quarantine or p=reject actually stops a forged From address. Business email compromise is among the costliest small-business cyber crimes in the US. Our scan reads these DNS records directly, so a missing or unenforced DMARC contradicts a 'yes'. BEYOND IG1: this is CIS Safeguard 9.5, an IG2 safeguard — included because insurers ask it anyway and you can fix it in an afternoon.
Data and backups
Knowing where sensitive data lives, encrypting the devices that carry it, and backups ransomware can't reach.
Do you know where your sensitive data lives — customer, payment and staff records — who can reach it, and do you delete it when you no longer need it?
Data you never kept can't be stolen. Data nobody can find can't be protected.
The detail (dig in)
A data-management process, an inventory of sensitive data, access lists that limit who can reach it, a retention period and secure disposal together shrink what a breach can expose — and what you'd have to notify people about under state breach laws. Maps to CIS Safeguards 3.1 to 3.5 (IG1).
Are laptops and phones that hold business data encrypted?
BitLocker on Windows, FileVault on a Mac; modern phones encrypt once a passcode is set.
The detail (dig in)
Full-disk encryption on end-user devices turns a lost or stolen laptop from a reportable data breach into a hardware cost — many state breach-notification laws exempt encrypted data. Maps to CIS Safeguard 3.6 (IG1).
Is important data backed up automatically, with at least one copy kept offline or somewhere ransomware can't reach?
Ransomware deletes the backups it can find. One copy disconnected, or 'immutable', is what makes recovery possible — and is what insurers ask about.
The detail (dig in)
A data-recovery process, automated backups, protection of the backup data, and an isolated instance of recovery data (offline, air-gapped or immutable cloud storage) are the IG1 recovery baseline. Testing that a restore actually works is Safeguard 11.5, an IG2 step — worth doing anyway. Maps to CIS Safeguards 11.1 to 11.4 (IG1).
People and incidents
Staff who can spot a phishing email, a named person and a plan for when something goes wrong, and logs to look back on.
Do staff get security-awareness training at least once a year — phishing, passwords, and how to report a mistake?
Short and regular beats long and annual. The most important lesson: report a click straight away, without blame.
The detail (dig in)
IG1 expects a security-awareness program covering social engineering, authentication, data handling, recognizing and reporting incidents, spotting missing updates and the risks of insecure networks. Social engineering precedes most small-business claims. Maps to CIS Safeguards 14.1 to 14.8 (IG1).
Is there a named person and a short written plan for a security incident — who to call, including your insurer, and who has to be told?
One page is enough: who's in charge, phone numbers, your insurer's breach hotline, and how you'd reach customers.
The detail (dig in)
A designated incident handler, an up-to-date contact list (insurer's breach panel, IT provider, legal counsel, law enforcement) and a known process for reporting incidents turn a panic into a checklist. Every US state has a breach-notification law with its own deadline, applied by where the affected people live, not where you are — the plan should say who checks which apply. Maps to CIS Safeguards 17.1 to 17.3 (IG1).
Is logging turned on for email and your important cloud accounts, and kept long enough to look back after an incident?
Microsoft 365 and Google Workspace keep sign-in and audit logs — check they're on and how long they're kept.
The detail (dig in)
An audit-log process, logs collected on the systems that matter, and enough storage to keep them are what let you answer 'what did they access?' — the question your insurer, your lawyer and a state attorney general will all ask. Maps to CIS Safeguards 8.1 to 8.3 (IG1).
Check your answers against your website (optional)
Enter your website and we'll run a quick, free passive check (HTTP headers, TLS and SPF/DMARC), then compare your encryption and email-spoofing answers to what the internet can actually see — flagging any ⚠️ contradictions. No login, nothing stored.
Leave blank for a questionnaire-only check.