SME Security Self-Check

1. 1. How are your backups organised?

   Following the 3-2-1 rule: at least three copies, two media types, one copy off-site or offlineRegular backups, but all in the same locationBackups run irregularly or manuallyI don't know
2. 2. When did you last test a restore from your backups?

   Within the last six months, documentedLonger ago than thatNever, or I don't know
3. 3. Do you use multi-factor authentication (MFA)?

   Yes, for all important accounts (email, VPN, admin access, cloud services)Partially, for some servicesNo
4. 4. How do you keep operating systems and applications up to date?

   Updates are applied promptly and in a controlled way (e.g. a fixed monthly patch cycle)Updates run automatically, but without an overview of what is installed whereIrregularly, or only when something stops working
5. 5. Do your employees work with administrator rights day to day?

   No – admin rights exist only via separate accounts and only when neededA few people permanently have admin rights on their devicesMany work with admin rights, or it is not regulated
6. 6. How are passwords managed in your company?

   A password manager and unique, strong passwords are the standardThere are guidelines but no tools – everyone applies them on their ownNo rules; passwords are also reused
7. 7. What happens to access rights when someone leaves the company?

   There is a checklist – accounts and access are deactivated on the last working dayAccounts get deactivated eventually, but without a fixed processOld accounts often stay active, or I don't know
8. 8. How do you protect yourself against phishing and malicious email attachments?

   Technical filters (e.g. SPF/DKIM/DMARC, attachment scanning) and regularly trained employeesOnly our email provider's standard spam filterNo particular protection, or I don't know
9. 9. Is there a plan for an IT emergency (e.g. a ransomware incident)?

   Yes – documented, with responsibilities and contacts, also available offlineThere are some ideas, but nothing bindingNo
10. 10. How are your databases (e.g. SQL Server) protected?

    Dedicated database backups with restore tests, restricted access, up-to-date patchesThe database just runs along – only the server as a whole is backed upI don't knowWe don't have our own databases
11. 11. Do you know which cloud services your employees use for work?

    Yes – there is an overview and rules about which services are allowedMostly, but without binding rulesNo, that is not tracked

Please answer all questions – at least one answer is still missing.