Home / Commons / Security self-assessment

Tool

How protected are you, honestly?

21 yes-or-no questions drawn from our security field guide. Answer them and get a to-do list in the order that matters, with a link to the guide for each item.

FreeNo sign-upNothing leaves your browserAbout ten minutes

Multi-factor authentication

Field guide: Turn on multi-factor authentication for email first
01Does every email account in your organization use multi-factor authentication?
02Is multi-factor authentication on for banking, payroll, your client or donor database and your domain registrar?
03Do people use an authenticator app or a security key for that second step, rather than text messages?

Administrator accounts

Field guide: Keep administrator accounts separate
04Do the people who manage your systems use a separate account for administration, and an everyday account for email and browsing?
05Is there a written list of who has administrator access to each system?

Backups

Field guide: Keep a backup ransomware can’t reach
06Is at least one copy of your important data offline, or in a service that prevents deletion for a set period?
07Have you restored something from a backup in the past six months to check that it works?
08Does the backup include what you would need to reopen: files, finance records and the configuration of key systems?

Knowing what you have

Field guide: Know what you have
09Do you have a current list of your devices, online accounts and services?
10Does that list include services that volunteers or former staff signed up for on the organization’s behalf?

Updates

Field guide: Let updates install themselves
11Are automatic updates turned on for computers, phones, browsers and office software?
12Are all your devices and software still receiving security updates from their maker?

People leaving

Field guide: Remove access the day someone leaves
13When staff or volunteers leave, is their access removed and are shared passwords changed the same day?
14Do you review who has access to what a few times a year?

Payments

Field guide: Make payment changes a two-person, two-channel rule
15Before changing anyone’s bank details, do you call them back on a number you already had?
16Does a second person approve changes to payment details?

Built-in protections

Field guide: Use the protections you already have
17Have you checked that your email and productivity platform’s recommended security settings are switched on?

Vendors

Field guide: Ask your vendors the hard questions
18For vendors that hold sensitive data, do you know where it is stored, how they would tell you about a breach and how you would get it back?

Insurance

Field guide: Read your cyber insurance before you need it
19Do you know whether you have cyber insurance, and if so, what you must do first and the number to call?

The first hour

Field guide: Write down the first hour
20Is there a written first-hour incident plan, printed and kept somewhere other than your office network?
21If email were down, could you reach every member of staff quickly?

Your to-do list

What to do, in order.

Answer the questions above and your list appears here.

This list needs JavaScript, which is turned off. The field guide covers every question above, in the same order.

Start here

The measures that stop the most common attacks on small organizations.

    Next

    Worth doing once the first band is done.

      In good shape

      Keep doing these, and check them again from time to time.

        This is a self-check, not an audit. It is general information, not advice about your systems. A “yes” here is only as good as the answer behind it.

        Want someone to check your answers?

        Shield gives eligible organizations a security review from the people who run Moraph’s security operations, a plan in the right order, and help making the fixes.

        Apply for Shield