Question 1

How are passwords and multi-factor authentication (MFA) handled for your important accounts — email, banking, cloud tools?

Accepted Answer

Unique passwords from a password manager, with MFA turned on everywhere that supports it

Question 2

If a convincing but fake email asked you (or a teammate) to click a link or open an attachment today, how confident are you it would be caught?

Accepted Answer

Very — we know the warning signs and verify unexpected requests through a second channel

Question 3

If ransomware locked every file you rely on tomorrow, what would recovery look like?

Accepted Answer

Restore from automatic backups we've actually tested, including a copy kept offline or offsite

Question 4

How do operating system and software updates get applied on the machines you work from?

Accepted Answer

Automatic updates are on everywhere, and we check that they actually applied

Question 5

Think about the laptops and phones used for work. What happens if one is lost or stolen?

Accepted Answer

Every device has a strong lock and disk encryption, and can be remotely wiped

Question 6

A supplier emails saying their banking details have changed and the next payment should go to a new account. What happens?

Accepted Answer

We always verify banking changes by phone, using a number we already had on file

Question 7

How does your team access shared cloud services — email, file storage, business apps?

Accepted Answer

Everyone has their own account, with only the access their role needs

Question 8

Is there any written guidance — even a single page — on how your business handles security (passwords, devices, data)?

Accepted Answer

Yes — it's written down, and staff actually see it when they join

Question 9

When someone leaves the company, what happens to their accounts and access?

Accepted Answer

Same day: a checklist covers every account, device, and shared credential

Question 10

Have your staff had any security awareness training — spotting phishing, handling sensitive data?

Accepted Answer

Yes — everyone has been trained, including new hires

Question 11

Beyond the default spam filter, is your company email protected — advanced filtering, and sender authentication (SPF/DKIM/DMARC) on your domain?

Accepted Answer

Yes — advanced filtering is in place, and SPF/DKIM/DMARC are configured and monitored

Question 12

If you discovered a breach at 9 a.m. tomorrow — an attacker in your email, or client data leaked — does a written plan say who does what?

Accepted Answer

Yes — a written incident response plan with named owners, and we've walked through it

Question 13

Does the business carry cyber insurance — and do you know what the policy requires of you?

Accepted Answer

Yes, and we meet the security controls the policy requires

Question 14

How do you assess the security of vendors and third parties that touch your data or systems?

Accepted Answer

We review security before signing, and keep a list of who has access to what

Question 15

Who can access your most sensitive systems and data — finance, HR records, admin consoles?

Accepted Answer

Access is role-based, reviewed periodically, and admin rights are rare

Question 16

What's running on company computers to detect and stop malware?

Accepted Answer

Managed EDR/endpoint protection on every device, with alerts someone actually watches

Question 17

Does your industry impose data protection or compliance obligations (PIPEDA, PHIPA, PCI, client security requirements) — and are you meeting them?

Accepted Answer

Yes — we know our obligations and audit ourselves against them

Question 18

How often does security training happen — once, or on a recurring schedule?

Accepted Answer

Recurring — at least annually, with periodic phishing simulations

How exposed is your business?