SELF-ASSESSMENT FOR SMES
25-question cyber security self-assessment for SMEs
Answer 25 practical questions across five key areas of SME cyber security. In 15 minutes, you’ll get a clearer view of where your business is strong, where there may be gaps, and what to prioritise before customers, insurers or tender questionnaires ask. For best results, complete it with your senior team and answer honestly.
See where your cyber security stands
Tick each statement that currently applies to your business. There are no “right” or “wrong” answers – the aim is simply to get a clearer view of where your cyber security looks strong, where there may be gaps, and what to prioritise next.
2026 CYBER RESILIENCE REPORT
Find out more in our new 2026 Cyber Resilience Report
Read the report in full in under an hour, or jump straight to the section that answers your current question.
- Why Cyber Security Is Now Commercial – how cyber resilience now affects contracts, insurance and customer confidence.
- The Microsoft-365 Gap – the common Microsoft 365 settings SMEs miss, and the checks to make first.
- Cyber Frameworks Compared – when Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 and NIST CSF matter.
- Monitoring & Evidence – what to record, review and keep ready before a customer or insurer asks.
- Zero Trust, Simply – how to reduce unnecessary access without slowing people down.
- The 90-Day Roadmap – a practical order of work: visibility, hardening, evidence and certification.
- The SME Self-Assessment – a 25-question cyber security check to run with your leadership team.
Meet Matt, Managing Director of INDIGO IT
Making Great IT Personal and Accessible
Frequently Asked Questions
Here are some of the most common questions businesses ask us:
What is a cyber resillience review?
A cyber resilience review checks how well the business can prevent, respond to and evidence cyber security controls. It usually covers Microsoft 365, identity, devices, backup, policies and commercial obligations.
How often should an SME review cyber security?
Quarterly is a sensible rhythm for most SMEs, with extra reviews before insurance renewals, major tenders, customer audits or significant Microsoft 365 changes.
Who can help set up a compliance portal or evidence library?
An IT and cyber security partner can help structure the evidence customers and insurers ask for, including policies, backup records, MFA evidence, Cyber Essentials documents and Microsoft 365 security settings.
How can an SME answer customer cyber security questionnaires?
Keep evidence ready: MFA status, backup testing, patching approach, Cyber Essentials position, incident response outline, Secure Score trend and a short summary of your current security posture.