Self-assessment for small businesses
Cyber security self-assessment: understand your starting point
Use these 25 questions to review the controls your business has in place and identify where you need more information. This cyber security assessment for small business is a useful starting point for a conversation with your leadership team. It is separate from the official Cyber Essentials self-assessment questionnaire.
The assessment
See where your cyber security stands
Tick each statement that currently applies to your business. Use the results to identify what is working well and where you need a closer review.
Report cross-promotion
Go deeper with the 2026 Cyber Resilience Report
- Why It’s Now Commercial - how cyber resilience now affects contracts, insurance and customer confidence.
- The Microsoft-365 Gap - the common Microsoft 365 settings businesses miss, and the checks to make first.
- Frameworks Compared - when Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 and NIST CSF matter.
- Monitoring & Evidence - what to record, review and keep ready before a customer or insurer asks.
- Zero Trust, Simply - how to reduce unnecessary access without slowing people down.
- The 90-Day Roadmap - a practical order of work: visibility, hardening, evidence and certification.
- The Self-Assessment - a 25-question cyber security check to run with your leadership team.
Making great IT personal and accessible
Meet Matt, Managing Director of INDIGO IT
Matt is passionate about technology and helping businesses to thrive with it. If your tech is in a tangle, he'd love to help you. Whether it's tricky tech, cyber security, or transforming your business's IT to achieve your goals, Matt can offer clear guidance, free from the technobabble.
Ready to make headway to exceptional IT? It all starts with an informal conversation!
Frequently asked questions
Questions we get asked about the self-assessment
If yours isn't here, call us on 01491 693424.
A cyber resilience review considers how your business protects its systems, responds to incidents and restores operations. It can include Microsoft 365, account access, devices, backups and the evidence needed for your business requirements.
Agree a review schedule around your risks and operating needs, with additional checks when systems, staff or requirements change. Insurance renewals, tenders and customer assessments are useful prompts to review the evidence.
Start with the actual questions and support your answers with current evidence, such as access settings, backup test records and update processes. Identify anything you cannot yet substantiate so it can be investigated.
Our team reviews the information submitted and suggests areas for further attention. The answers provide a starting point for discussion, rather than a technical audit or certification decision.