This isn't a test. There's no score, no grade, and no judgment attached to any answer. It's a diagnostic. Each question points at something specific and tells you whether it's worth a closer look.
Matt Vaillancourt, Director, Security SalesNETGEAR Enterprise
IN THIS ARTICLE
Work through it with whoever handles IT or security at your organization. Give honest answers. “We think so” and “we haven’t checked recently” are both useful pieces of information. The questions that make you pause are the ones worth following up on first.
This assessment focuses on the areas that show up most consistently in post-breach analysis: credential security, patch management, access control, backup integrity, incident preparedness, and network visibility. It covers the fundamentals, not the advanced. If any of these ten questions get an uncertain answer, that’s a good place to start.
What good looks like: MFA is on email, cloud storage, financial accounts, your domain registrar, any admin panel, and any SaaS tool with sensitive data. Your password manager has MFA. Exceptions are documented, intentional, and reviewed regularly.
What most businesses find: MFA on email, sometimes on cloud storage, rarely on the domain registrar or financial platforms. The domain registrar is worth checking specifically. An attacker who controls your domain controls your email, which gives them a path to almost everything else.
What good looks like: Firmware is on a patch schedule, same as operating systems. Someone knows where to check for updates and roughly how old the current version is.
What most businesses find: The firmware hasn’t been updated since the device was installed, sometimes years ago. The default admin credentials haven’t been changed either. Both are worth fixing this week. Many routers include a built-in update check, although the process and time required vary by device.
What good looks like: Backups run automatically, include everything that matters, and are offline, immutable, or otherwise isolated from the systems they protect. You’ve successfully restored from the backup at least once in the last twelve months.
What most businesses find: At least one account belonging to someone who left the company, and at least one service account whose origin nobody can explain. Both are low-effort to clean up once they’re visible.
What good looks like: Backups run automatically, include everything that matters, and are stored somewhere ransomware can’t reach them. You’ve successfully restored from the backup at least once in the last twelve months.
What most businesses find: No central list, several vendors with access that hasn’t been reviewed, and at least one vendor relationship that ended without the access being removed. The review is often straightforward once you know what you’re looking for.
What good looks like: A document exists that covers, at minimum, who gets called first, what gets isolated immediately, who communicates externally, and where your cyber insurance policy lives. It doesn’t need to be long, but it does need to exist before the incident.
What most businesses find: No written plan, or a plan that was created once and never reviewed. The most common gap in the plan, when it exists: nobody knows where the insurance policy is or what the notification requirements are.
What good looks like: Every vendor with access to your systems is on a list. Their access level is documented. You’ve reviewed it in the last six months. You’ve revoked access for vendors whose engagement has ended.
What most businesses find: No central list, several vendors with access that hasn’t been reviewed, and at least one vendor relationship that ended without the access being removed. This is a half-hour task once you know what you’re looking for.
What good looks like: Your team encounters current, relevant threat examples more than once annually. This doesn’t have to be formal training. Sharing a recent phishing example in a team meeting counts. What doesn’t count: the annual compliance module everyone watches while eating lunch and scrolling TikToks on their phone.
What most businesses find: One compliance module is completed per year because it’s required; the content is retained briefly, then forgotten. The teams that catch things have regular exposure to what attacks look like, not a general module about why security matters.
What good looks like: You have a current inventory of devices connected to your network. New or unrecognized devices are reviewed promptly. Personal devices are either managed or isolated to a guest segment.
What most businesses find: More devices than expected. Smart TVs in conference rooms, personal phones on the main network, a printer that’s been there so long the only person who knows it exists is the one who orders the dot matrix paper. All of these are worth knowing about, but that doesn’t automatically make them threats. The greatest risk is not knowing what’s in your inventory at all.
What good looks like: You have some view into outbound traffic. You can see which devices and applications are connecting externally, where traffic is going, and whether anything looks unusual. A converged network and security platform like NETGEAR Exium makes this visible without requiring a dedicated analyst to interpret it.
What most businesses find: No outbound visibility at all. The organization may have basic firewall protection but no practical way to review outbound connections or see where applications are sending data. This gap separates organizations that catch things early from those that find out months later. “We trust the firewall” is a partial answer at best.
What good looks like: You have a policy. You’ve read the coverage summary in the last twelve months. You know the incident notification window, because policies may require reporting within a specific timeframe. You know whether it covers ransomware, business interruption, and third-party liability.
What most businesses find: A policy exists, but nobody has read the coverage terms since they bought it. Notification requirements vary by policy, and failing to meet them can jeopardize coverage for an incident. “We have it” and “we know what it covers” are different.
Pick the two questions where your answer was least confident. Start there.
Security improvements compound when you make them. Many of the issues this assessment surfaces can be addressed quickly, while others will require a longer-term plan. Restore testing, firmware updates, and access reviews are not abstract security projects. They are concrete tasks that need an owner and a deadline. Put them on the calendar, assign responsibility, and follow up.
The value of doing this in October specifically is that it creates a natural checkpoint. Set a date in December to review what you’ve fixed, what remains open, and who owns the next step. That puts your business in a meaningfully better position heading into the new year.
Catch up on the earlier blogs in this series:
And join us for a live webinar on October 20 (8 a.m. PT | 11 a.m. ET): The moat is full of phish: how modern security protects a business without walls. I’ll lead a discussion about what SASE and Zero Trust are, and what they look like on an ordinary working day, plus how NETGEAR Exium delivers both through NETGEAR Insight. Save your seat.