Network & Vulnerability Readiness Check

These questions are about how your organization manages its network – never about patients, passwords or IP addresses. Answer what you know. Anything left as Not sure is excluded from the score rather than counted against you.

Know your devices

Do you have an up-to-date list of every device connected to your network?

Computers, laptops, servers, printers, Wi-Fi equipment, phones on the office network – anything plugged in or connected. You cannot protect what you do not know is there. Partly: if a list exists but has not been checked in the last 6 months, or leaves out some kinds of devices.

Yes Partly No Not sure

Vulnerability scanning

Has your network been scanned for security weaknesses in the last 12 months?

A vulnerability scan is an automated check, run with your permission, that looks for missing updates and weak settings on your devices. An antivirus program alone does not count. Partly: if only some devices or locations were scanned, or the last scan was more than 12 months ago.

Yes Partly No Not sure

Remote access

Do you know every way someone can reach your systems from outside the office, and is each one protected with a second sign-in step?

Remote desktop, VPN, remote-control or support tools, and web portals for staff. Unknown or unprotected remote access is one of the most common ways attackers get in. Partly: if you know some routes but not all, or some are protected and others are not.

Yes Partly No Not sure

Updates and patching

Are security updates installed on computers, servers and network equipment within 30 days of release?

This includes Windows and Mac updates, business software, and the firmware on routers, firewalls and Wi-Fi equipment, which is often forgotten. Partly: if computers are updated but servers or network equipment are not, or updates are irregular.

Yes Partly No Not sure

Evidence

Could you show an insurer, auditor or client evidence of how you find and fix security weaknesses?

For example a recent scan report, a list of issues and when they were fixed, or a written process. Insurers, auditors and clients increasingly ask for this. Partly: if you have some records but they are incomplete or out of date.

Yes Partly No Not sure

About your organization

How many people work in your organization?

An approximate number is fine.

Where should the report go?

Email me my results, and contact me about them. CyberShield Advisory LLC will use my answers and my email address for that and nothing else. I can unsubscribe from any message, and ask for my record to be deleted at any time. How we handle your data.