Where is the business exposed, and what would it cost you?

What the 18 questions cover

• Cybersecurity Posture

  Does your business have a documented cybersecurity policy that staff are actually aware of? If a key system were compromised today, would you know within hours rather than days or weeks? Has a professional security review (audit, penetration test, or assessment) been done in the last 12 months?

• Business Continuity & Resilience

  Is there a written plan for what happens if your main system or office becomes unavailable? Has that plan actually been tested, rather than just written and filed away? If your most critical person left tomorrow, could the business keep running without them?

• Cloud & Infrastructure Readiness

  Is your core infrastructure (servers, cloud, hosting) actively managed, or does it run until something breaks? Could your systems handle a sudden doubling of customers or transactions without falling over? Do you have visibility into what you're actually spending on technology each month, and why?

• Governance & Compliance

  Do you know which data protection or industry regulations actually apply to your business? If a regulator or auditor asked for evidence of your controls tomorrow, could you produce it within a week? Is there a named person responsible for compliance and data protection, even if it's not their full-time role?

• Data Management

  Do you know where your business-critical data actually lives, across every system and spreadsheet? Is there a single source of truth for key business numbers, or do different reports disagree with each other? If you lost access to your main system today, how much data would you lose that was never backed up?

• Operational Resilience

  Could your business keep serving customers through a full day of internet or power disruption? Are your critical processes documented well enough that a new hire could follow them without asking around? When something goes wrong operationally, is there a clear process for catching it early, or does it surface from a customer complaint?