Have you identified your most likely and impactful cyber risks?

Do you have a current security policy and is everyone trained on it?

Is multi-factor authentication required for all users and all applications?

Is critical data backed up to an off-premises, isolated, location and is recovery of your data regularly tested?

Is endpoint detection and response software installed on all endpoints?

Are you performing ongoing security monitoring and are critical issues responded to in a timely manner?

Are your computer systems regularly patched?

Is corporate data on mobile devices protected from loss?

Are system administrator accounts separate from those used for email and web browsing?

Are users restricted from adding or using applications without approval?

Is logging enabled so you can detect and understand the scope of a security incident?

Do you have a cyber insurance policy that provides adequate coverage?