Security Basics Check

Eight questions, based on NIST's cybersecurity basics for small businesses. See what you're missing and what covers it.

Check your business against the eight basics

Answer each question for your business as it runs today. Nothing you choose leaves this page.

  1. Multi-factor sign-in on all accounts offering it Does everyone use a second sign-in step (a code or app prompt) for email and other business accounts?
  2. Strong passwords; consider a password manager Does your team use a password manager, with a different strong password for each account?
  3. Back up data and test backups Is your business data backed up, and have you tested restoring it?
  4. Change default passwords on devices Have the factory passwords on your router, firewall, printers and cameras been changed?
  5. Keep antivirus installed and updated Does every work computer run antivirus or threat detection that updates itself, and does someone check its alerts?
  6. Update and patch all software Are operating systems and software updated promptly on every work device?
  7. Learn about phishing and ransomware protection Is incoming email filtered for phishing and malicious attachments?
  8. Train staff in basic cybersecurity Has your staff had security training, including how to spot a phishing email, in the last year?

Frequently Asked Questions

NIST, the National Institute of Standards and Technology, lists eight cybersecurity basics for small businesses: multi-factor sign-in, strong passwords, backing up and testing data, changing default passwords, updated antivirus, software patching, learning about phishing and ransomware, and staff training. Source: NIST Cybersecurity Basics, updated August 2026.

Not reliably for a small business. An ROI figure needs an estimate of how much each control lowers your chance and cost of an incident, and there is no dependable figure for that at small-business scale, so any percentage would be a guess. This check shows which basics are missing instead. To compare what your IT costs today with an Onward plan, use the IT cost calculator.

Industry data: in the Verizon 2026 Data Breach Investigations Report, the median ransom paid was $139,875, and about 96% of ransomware victims were small and medium-sized businesses where organization size was known. A ransom is only part of the cost; downtime, recovery work and lost data add to it. Source: Verizon 2026 Data Breach Investigations Report.

Two stand out in the industry data. Microsoft reports that over 99% of account takeover attacks can be blocked with a second sign-in step (Microsoft Learn), and Verizon's 2026 report found that 31% of breaches now start with software vulnerabilities, which patching closes (Verizon DBIR).

Managed IT includes a service for 2 of the 8 basics, Secure Essentials 6, Secure Professional 8 and Secure Enterprise 8. Reviewing and updating device passwords is a one-time onboarding step; it does not include remediation unless the quote says so. A matching service does not mean every part of a basic is covered. For example, backup testing is not listed.

No. The check runs in your browser. Your answers are not saved or sent to Onward or anyone else.

Need Help with Your Results?

Our experts can review your results and provide personalized recommendations.

Schedule a Consultation