Leck Tech Contact

Small Business Cyber Risk Scorecard

Answer 23 questions (a few more if you handle card payments, patient data or consumer finance) and get an instant score with your biggest gaps and what to fix first. About 5 minutes.

  • Free, no email required to see your results
  • Your answers stay in your browser unless you choose to send them
  • Based on the CIS Critical Security Controls (IG1) and CISA Cyber Essentials

Answer honestly. “Not sure” counts as a gap, because not knowing is itself a finding.

About your business

Do you accept credit or debit card payments?
Do you create, store or access patient health information?
Do you offer consumers financing, loans, leases or tax preparation?
How many people work in your business?

Accounts and access

Every email account, including the owner's and any shared mailboxes, requires multifactor authentication (a code or app prompt, not just a password).
Remote access to your network (VPN, remote desktop, remote support tools) requires multifactor authentication, or you have no remote access at all.
Staff use everyday accounts without administrator rights, and admin access is limited to the few people who need it.
When someone leaves, all of their accounts (email, software, building and alarm codes) are disabled the same day.
Staff use a password manager instead of reusing passwords, spreadsheets or sticky notes.
You know exactly which outside vendors and IT providers have administrator access to your systems.

Email

Your email domain has SPF, DKIM and DMARC records set up, so others cannot easily send email pretending to be you.
Incoming email passes through filtering for phishing links and malicious attachments beyond the basic defaults.
Any request to change bank details or send an urgent payment is verified by phone, using a number you already have.

Computers and devices

All computers install operating system and software updates automatically, within about two weeks of release.
No computer or server runs an operating system that no longer gets security updates (Windows 10 support ended in October 2025).
Every computer runs modern endpoint protection (EDR or managed antivirus) that someone actually monitors.
Laptops are encrypted (BitLocker or FileVault), so a lost or stolen laptop does not expose your data.

Backups and recovery

Your important data (files, email, line of business systems) is backed up automatically at least once a day.
At least one backup copy is offline or immutable, so ransomware that reaches your network cannot encrypt or delete it.
Someone has successfully restored files or a system from backup within the last 12 months.

Network

Your internet connection is protected by a business grade firewall that is still supported and kept up to date.
Guest Wi Fi, cameras and smart devices are on separate networks from your business computers.
Nothing on your network (camera recorders, remote desktop, file servers) is reachable directly from the internet unless it must be.

People and planning

Staff get security awareness or phishing training at least once a year.
Staff know exactly how to report a suspicious email or a mistaken click, and feel safe doing it.
You have a written plan for a cyber incident: who to call, how to reach your insurer, and how to keep operating.
You have cyber insurance, and every security control listed on your application is actually in place.