Hacked or under attack right now? Call 1300 566 652 Don’t wait on email.

Free tool · 3 minutes

Cyber security self-check

Twelve quick questions about your website, email, logins, backups and planning. Get a score, your biggest gaps and what to fix first.

Start the self-check

What should a cyber security self-check cover?

A quick cyber security self-check asks whether you have multi-factor authentication, prompt patching of your website and devices, an enforced DMARC record, tested offline backups, limited admin rights, prompt offboarding, staff training, endpoint protection, an incident plan and clarity on your Privacy Act obligations. Gaps in the first five cause most of the incidents we see.

1. Do all staff use multi-factor authentication (MFA) for email and Microsoft 365 or Google?

MFA blocks the vast majority of account takeovers from stolen passwords.

2. Is MFA enabled on your website admin, hosting, domain registrar and banking logins?

These are the keys to your website, email and money.

3. Has your website CMS and every plugin or extension been updated in the last 30 days?

Out-of-date plugins are the most common way business websites are hacked.

4. Are computers, phones and software updated automatically or within two weeks of a release?

Patching is two of the Essential Eight strategies.

5. Does your email domain have a DMARC policy set to quarantine or reject?

Without it, anyone can send email that looks like it came from you.

6. Do you keep a backup attackers cannot change, and have you test-restored it in the last 6 months?

Ransomware targets backups first. Untested backups often fail.

7. Do staff use standard (non-admin) accounts for everyday work?

Admin rights let malware do far more damage.

8. Is access removed the same day someone leaves (staff, volunteers, contractors, agencies)?

Forgotten accounts are a common, quiet way in.

9. Have staff had phishing training in the last 12 months, and do you verify bank detail changes by phone?

Invoice fraud relies on someone acting on a convincing email.

10. Do all computers and servers run up-to-date endpoint protection (antivirus or EDR) that someone monitors?

Unmonitored protection often misses or ignores alerts.

11. Do you have a written plan for who to call and what to do in a cyber incident?

The first hours decide how bad an incident gets.

12. Do you know whether the Privacy Act and Notifiable Data Breaches scheme apply to you?

Getting this wrong after a breach makes a bad situation worse.

Your answers stay in your browser. Nothing is sent to us unless you choose to get in touch.

Want a professional opinion?

The self-check is a starting point. An Essential Eight assessment tells you exactly where you stand, with evidence.

Book a consult1300 566 652

Organisations Noah and the team have built, secured and supported

  • Bendigo Bank
  • WA Department of Education
  • MND NSW
  • RSPCA
  • SIDE
  • Soroptimist International
  • Speck Pumps
  • Midland Cement Materials
  • Clifton Legal Group
  • MediaBlitz
  • Winboard
  • Vogt Legal
  • Cool Chain
  • Banjima Native Title Aboriginal Corporation
  • Central Desert
  • MA Legal Group