How would you rate your company’s current cybersecurity maturity? 1 – Little to no security in place 2 – Starting to work on a security plan 3 – Expected / average security level 4 – Pretty good security controls in most areas 5 – Excellent security across all areas

Do you use anti-virus software? No, we don't have any installed… We have some standalone antivirus software on most devices We have a centrally managed antivirus system I don't know

Do you have a firewall installed? No, we don't use a firewall. We have whatever our cloud provider / web hosting company uses Yes, we have firewall at our network perimeter and/or WAF/DDoS protections

Do you use 2-factor authentication? No, we don't use this. Here and there, but not everywhere. We use 2FA to login to all company apps and systems with customer data I don't know.

Do you run vulnerability scans or penetration tests? No, we've never done this. Once or twice in the past. Yes, we run these tests at least annually and get a formal report I don't know.

Do you have backups / disaster recovery planning? Nope For critical systems only, but with limited security around them. Yes, we have scheduled backups in secure storage. I don't know.

Do you encrypt sensitive data? No, we don't encrypt any data. Some of our staff encrypt their devices. All user devices are encrypted and customer data is encrypted within all systems including databases and CRMs, at-rest and in-transit. I don't know.

Do you have security policies in place? Nope Somewhere around here, but we don't really look at them regularly. Yes, we have a comprehensive set of policies which we've reviewed in the past year. I don't know.

Do you give your staff cybersecurity training? No, we haven't done any training for this We have previously done some ad-hoc training Yes, we have a cybersecurity awareness program for new staff and refreshers for the company as a whole I don't know

Have you implemented Access Control for your IT systems? No, we don't have any ACL We have some around who can access certain things Yes, we use role-based access control and we monitor access to sensitive data I don't know