Five security questions every small business should be able to answer

Most small businesses think security starts with buying something — a firewall, an antivirus subscription, a service with a reassuring name. It doesn't. It starts with being able to answer a few plain questions about how your business actually runs.

If you can answer these five honestly, you already know more about your risk than most companies your size.

1. Who can get into what?

Not the polished org chart — the real list. Every account, every shared login, every ex-employee whose access nobody remembered to switch off. If you can't produce that list in an afternoon, that gap is the finding.

2. What happens if a laptop disappears tomorrow?

A laptop is stolen, or someone clicks the wrong link. Do you know what's on it, whether it's encrypted, and who to call first? A one-page answer written before the bad day is worth more than a binder written after it.

3. Have you ever actually restored a backup?

Having backups and having working backups are different things, and the difference only shows up when you need them. The test is simple:

Pick a file. Delete it. Restore it from the backup. Time how long it takes.

If nobody has ever done that, you don't have backups — you have hope.

4. What are your vendors doing with your data?

The tools you rely on hold your customer data, your files, your email. If one of them is breached, you inherit the problem. You don't need a formal program for this — just a list of who touches your data and a rough sense of whether you'd trust them with it.

5. Would your team know a scam when they saw one?

Most breaches don't start with clever hacking. They start with a convincing email and a busy person. A fifteen-minute conversation with your team about what a real attack looks like beats most of the software you could buy.

None of this needs a consultant. If you can answer all five, you're ahead of most. If a couple made you wince, that's not a reason to panic — it's just the honest starting point, and it's exactly where good security work begins.

Want to see roughly where you stand right now? Try the free readiness check — it runs entirely in your browser and nothing you enter is stored anywhere.