Free Self-Check · Questionnaire Readiness

Twelve questions. One honest score.

Customers, cyber insurers, and funders don’t just ask what you do — they ask you to show it. This self-check asks their question twelve ways: could you produce the evidence within one business day? Answer honestly and see where your evidence stands, and which areas a reviewer would press first. Your answers stay in this browser — nothing is sent or stored.
Start the self-check Get the full checklist instead
About three minutes · drawn from the 35-item Security Questionnaire Readiness Checklist
The Self-Check

Answer for what you could produce — not what you believe is in place.

Every question is about evidence: a document, a record, or a report with a date on it. Yes means you could produce it within one business day. Partially means it exists for some systems or some people, or it exists but is out of date. No means it isn’t written down anywhere you could hand over.

0 of 12 answered
Area 1 · Know what you have
Could you produce a current inventory of the computers, servers, and devices your business uses?

What counts: the inventory itself, plus your list of cloud services and software with who administers each one.

Area 1 · Know what you have
Could you produce a map of what customer, patient, or client data you hold, and where it lives?

What counts: a data map or written summary naming the data, the systems it sits in, and how your network fits together.

Area 2 · Control who gets in
Could you produce proof that multi-factor authentication is enforced on email, remote access, and administrator accounts?

What counts: an MFA coverage report from your identity provider showing who is enrolled — not a screenshot of one person’s phone.

Area 2 · Control who gets in
Could you produce a current list of accounts with administrator rights, and a dated record of your most recent access review?

What counts: the admin list, named accounts with no shared logins, and the review record showing leavers lose access when they leave.

Area 3 · Keep systems defended
Could you produce your most recent patch report and an endpoint protection coverage list?

What counts: dated patch or update records, a coverage list showing protection on every device, and a recent vulnerability scan with its results.

Area 4 · Back up — and prove recovery
Could you produce a documented backup schedule — what is backed up, how often, and where it is kept?

What counts: the written schedule, including how backups are protected against ransomware and the retention period your policy states.

Area 4 · Back up — and prove recovery
Could you produce a dated record of a restore test — a time you actually recovered data from your backups?

What counts: the restore-test record with its date and result. A backup schedule is a claim; a dated restore test is evidence.

Area 5 · Be ready for an incident
Could you produce a written incident response plan with the contact list for your first phone calls?

What counts: the plan, however short — named roles, and the first calls listed: IT provider, insurer, bank, legal counsel — plus notes from a walkthrough or a real incident.

Area 6 · Govern it on paper
Could you produce an information security policy that is dated and signed, and your most recent risk assessment?

What counts: the signed policy document itself and the risk assessment as a document — not a description of either.

Area 6 · Govern it on paper
Could you produce a risk register — each significant risk, its owner, and its treatment — with findings shown closed?

What counts: the register, plus a remediation tracker showing findings you have closed, not just opened.

Area 7 · Prepare your people
Could you produce security awareness training records for your staff, and signed acceptable-use acknowledgments?

What counts: completion records by name and date, phishing-awareness results if you run them, and the signed acknowledgments themselves.

Area 8 · Manage your vendors
Could you produce a list of the vendors that can access your systems or your data, with the agreements you hold with them?

What counts: the vendor inventory, signed data-protection or business-associate agreements where they apply, and a security review on file for critical vendors.

A few questions are still unanswered — they’re outlined above.
0%Evidence readiness

Where the evidence is thinnest
↓ Download the full checklist (PDF) Book a Risk Conversation

This self-check is general guidance for planning purposes. It is not an audit, and a score here does not by itself establish compliance with any framework or regulation. Your answers were scored in your browser and were not sent or stored.

Why Clyvara

Depth a generalist can’t offer. Access an enterprise firm won’t give you.

Research-Backed
The methodology behind every engagement is grounded in original doctoral research into why SMB cybersecurity programs actually fail.
Focused
Clyvara doesn’t sell IT support or general consulting. Cybersecurity advisory is the entire practice.
Accessible
Direct access to a credentialed principal consultant — not a junior analyst routed through account layers.
Start Here

Start with the score. Then close the gaps.

The full checklist turns this score into 35 tick-boxes you can work through item by item. If boxes stay unticked, Clyvara’s Risk & Readiness Assessment turns them into a documented risk register and a remediation roadmap — the evidence pack behind every future questionnaire.

↓ Download the checklist (PDF) Book a Risk Conversation