I trust my IT provider to make sure I’m protected.

We’ve invested in a good firewall and I’ve mentioned to my staff to be careful.

We invest heavily in cybersecurity and constantly drive awareness amongst our staff.

I think my passwords are strong enough, and I don’t really monitor what my staff does.

I’ve mentioned to my staff that they should use good passwords, and maybe even to have a few different ones.

I enforce strong password policies and require that every site or application we use has a different password.

I’m not sure, but I think my IT people take care of this.

I believe our workstations are updated automatically, not sure about the rest.

We have very strict controls and routines around updating all aspects of our network devices and computers.

We briefed everyone and we elaborated a fairly detailed IT security policy.

We have an IT security policy, and the subject comes up at least once a year during meetings or kickoffs.

We pretty much live and breathe cybersecurity; we have very strict controls and provide continual training to all our employees.

…we might be down for a few days to a week - or more - until we’re operational again while we purchase a new server, get it setup, and restore all our data.

…some of our applications and data might not be accessible until we get the systems all reinstalled and restored, but our most critical business apps and data are in cloud-based applications.

…we could just send everyone home or relocate to a temporary office and keep working, since all our applications and data are on a cloud-based server.

Force users to change passwords on a regular basis (e.g.: every 90 days)?

Let users change their passwords whenever they want and don’t really manage that?

Provide all users with a password manager and train them on using complex passwords?

Have a basic set of applications, but generally let users install and use what they need to get their work done.

Install a basic set of applications, and if they want/need anything else they have to check with management first. If we approve, then they can install it. We also keep a spreadsheet with an inventory of all the software we use.

Lock down the workstations with tight policies; users cannot install anything unless they go through our IT services. We also have an automated workstation inventory that allows us to see what’s on each PC.

Our business is not really subject to any specific regulations.

We are aware of privacy regulations, and we have a privacy policy available on our web site.

We are not only aware of the privacy regulations in our jurisdiction, but we have an action plan to execute in the case of a security breach.

We have an antivirus/antimalware software on all our workstations, and it’s configured to auto-update.

We have an antivirus/antimalware solution on all our devices and our IT service provider manages it.

We have an antivirus/antimalware solution on all our devices that is centrally managed, and we get regular reports that show that everything is updated.

Not really. We feel that we are Ok with what we have; and anyways, who’d want to hack us? We’re just a small business!

Yes, we’ve invested a lot of money on equipment, security solutions, and managed services to help protect us. We’re pretty bulletproof.

We’ve invested a fair amount in technology solutions, but we’ve also addressed the peopleware side of things, making sure they have the understanding, the skills, and the tools to contribute to protecting our data.