Built By Base Code
Built By Base Code
Secure. Automate. Scale.
Self-audit
Cybersecurity for small business
builtbybasecode.com/audit/cybersecurity

Is your business cyber-ready?

Eighteen yes/no questions across the areas that catch most small businesses out. Ten minutes to complete. Score at the bottom, interpretation and next steps on the reverse.

How to score. Tick Yes (2 pts) if you are confident this is in place. Tick Not sure (1 pt) if you think so but haven't checked, or if only some of your team meets the standard. Tick No (0 pts) if you know this is not currently the case. Add up your total on the reverse.

01Accounts & access 4 questions

1.1
Multi-factor authentication (MFA) is on for your email, business banking, and accounting software.
1.2
Every person on your team has their own login for every business system. No shared accounts.
1.3
Your team uses a password manager. Passwords are not stored in notebooks, spreadsheets, group chats, or browser autofill on shared devices.
1.4
When a staff member leaves, their access to all business accounts is removed within 24 hours.

02Backups 3 questions

2.1
You have at least three copies of every important business file. One live, two backups on different media.
2.2
At least one backup lives physically off-site. A separate cloud service, an external drive kept at home, or similar.
2.3
You have restored a file from your backup in the last 90 days to confirm the restore actually works.

03Devices & software 3 questions

3.1
Every work computer installs security updates automatically (Windows Update, macOS Software Update turned on).
3.2
Every work laptop has full-disk encryption on. BitLocker on Windows, FileVault on macOS. If a laptop is stolen, the disk contents are unreadable.
3.3
Every work device has a screen lock that engages automatically within 5 minutes of inactivity.
Built By Base Code
Built By Base Code
Secure. Automate. Scale.
Self-audit · continued
Cybersecurity for small business
builtbybasecode.com/audit/cybersecurity

04Email, web, phishing 3 questions

4.1
Your business email domain has SPF, DKIM, and DMARC records configured. Ask your IT provider or web host if you are not sure. This is a common Not sure.
4.2
Your website uses HTTPS on every page. The padlock icon appears in the browser address bar on every URL.
4.3
You and your team can spot a phishing email and know exactly where to forward suspicious messages.

05Data & compliance 3 questions

5.1
You know where customer personal information lives across your systems (spreadsheets, CRM, email attachments, forms). You could produce that list on request.
5.2
You have a written retention policy for customer data (how long you keep records) and dispose of old data securely.
5.3
You are aware of the Notifiable Data Breaches scheme under the Privacy Act 1988 and know who to notify in the first 24 hours of a suspected breach.

06Incident readiness 2 questions

6.1
You have a written incident response plan, even a single page, that names who does what if something goes wrong. It lives somewhere accessible if your email is compromised.
6.2
You have cyber liability insurance in place, OR you have deliberately decided not to and understand the financial exposure that decision carries.
Built By Base Code
Built By Base Code
Secure. Automate. Scale.
Score & next steps
Cybersecurity Self-Audit
builtbybasecode.com/audit/cybersecurity
Add your ticks · Yes = 2, Not sure = 1, No = 0 Maximum possible: 36. Write your total in the box.
/ 36

What your score means

Well managed 28 to 36

You have the essentials in place. Most small businesses do not. The next question is whether the current setup keeps pace as the business grows, and whether the documentation exists so someone else could take it over if you stepped away. A partner can help pressure-test the gaps you might not see and lift you from "well managed" to "genuinely resilient".

Foundations, with gaps 15 to 27

You have real foundations, and you also have gaps that quietly turn into problems. This is where most small businesses land, because owners are busy running the business, not the IT. A written scope with the two or three highest-impact fixes usually delivers more security than another year of ad-hoc effort.

Exposed 0 to 14

Your business is more exposed than most owners realise. This is not a judgement. It is the honest starting point for a lot of small businesses that have grown up on consumer-grade tools. The good news is that most of what shows up in the audit is fixable in a 2 to 6 week project at a fixed price, and the highest-impact items are usually the cheapest and quickest.

Wherever you scored, do these three things this month

  1. Turn on MFA for your three most important accounts if it is not already on: business email, business banking, and accounting software. Fifteen minutes total.
  2. Restore one file from your backup. Any file. If the restore does not work, you do not have a backup. You have a wish.
  3. Write down what would happen in the first hour of a breach. Who calls the bank. Who calls the accountant. Who resets the passwords. Where the backup lives. One page. Save a copy outside your normal email.
Ready to talk it through?

Book a free 30-minute discovery call.

Thirty minutes to walk through where your business sits today and what to tackle first. No obligation. Fixed-price scope within 5 business days if a project fits.

Book at builtbybasecode.com/contact Or email services@builtbybasecode.com · We reply within one business day.
About Built By Base Code. We are a local IT consultancy based in Ballina, serving small businesses across Ballina, Byron, Lismore, Casino, and Tweed. We build cybersecurity, process automation, and cloud infrastructure. Every project is quoted at a fixed price in writing, and you own the end result outright, with documentation, credentials, and training at handover. No lock-in contracts.