Thirteen controls. How many can you prove?

Are backups running daily, held somewhere ransomware cannot reach, and has a restore actually been tested in the last three months?

Are workstations, servers, browsers and Office patched automatically, with critical fixes applied within days rather than months?

Does every laptop, desktop and server run actively updated anti-malware or EDR, including the ones that rarely come into the office?

Do all staff complete cyber awareness training with attendance recorded, not just a slide deck at induction?

Is MFA enforced by policy on every email account and every admin account, not just switched on for whoever opted in?

Are admin rights limited to people who need them, reviewed regularly, and kept separate from day-to-day logins?

Do privileged users keep credentials in a managed password vault with MFA and auditing, rather than browsers or spreadsheets?

Are SPF, DKIM and DMARC published on every sending domain, with DMARC set to quarantine or reject rather than none?

Is there a written cyber security policy staff have signed, and an incident response plan with named contacts you could open tonight?

Are SMS, voice and email codes disabled as MFA methods, leaving authenticator apps or hardware keys only, even as a backup?

Is there anything stopping an unapproved program, downloaded or emailed, from simply running on a staff laptop?

Are Microsoft Office macros blocked by default across the fleet, with only vetted, signed macros allowed to run?

Are browsers, Office and PDF readers hardened by policy: web ads and Java blocked in browsers, Office child processes and OLE restricted, and Internet Explorer 11 removed?