Free self-audit

Could your company still operate tomorrow morning?

93 questions across 15 domains, to find not only the technical holes but the organisational weaknesses that stop a company from working: a backup nobody has ever restored, an IBAN change approved by email, a provider who is the only one holding the admin passwords.

Nothing to install, no sign-up, nothing collected. Your answers stay in your browser; the scoring runs there too.

  1. Answer honestly — "I don’t know" is a legitimate answer, and the most informative one.
  2. Read the warning signs — one sentence per domain; if it describes you, the domain is a risk whatever the score says.
  3. Keep the report — copy it, print it, or have us read it: it is the starting point of a real audit.

Workstations, servers and updates

Risk : Intrusion through a known flaw that was patched elsewhere months ago.

  1. 1Does the company know the list of its workstations, servers and business phones?

  2. 2Do the installed systems still receive security patches from their vendor?

  3. 3Are security patches applied within a month of being released?

  4. 4Is malware protection genuinely active on workstations and servers?

  5. 5Are laptop drives encrypted?

  6. 6Can a lost or stolen device be locked or wiped remotely?

Warning sign — A file server still runs an operating system that no longer receives patches, because "the business application does not work on the next version".

Accounts, passwords and authentication

Risk : One password is enough to get in, and nobody can tell who did.

  1. 7Does every person have their own named account, with no shared accounts?

  2. 8Is multi-factor authentication active on email and remote access?

  3. 9Are passwords kept in a dedicated manager rather than in a file or a notebook?

  4. 10Are passwords different from one service to the next?

  5. 11Are the accounts of people who leave disabled on their last day?

  6. 12Is the list of existing accounts reviewed at least once a year?

Warning sign — An "accounting" or "management" account is shared by several people: no action can be attributed to anyone any more.

Backups and restores

Risk : Backups exist, but nobody has checked that they restore.

  1. 13Is important data backed up automatically, with no daily action from anyone?

  2. 14Is there an offline or immutable copy, unreachable from the network?

  3. 15Is a copy kept outside the company premises?

  4. 16Has a restore actually been performed in the last twelve months?

  5. 17Do you know how long a full restore takes?

  6. 18Are online services (email, cloud, management software) backed up somewhere other than at their provider?

Warning sign — The backup sits on a drive permanently connected to the server: ransomware encrypts it along with the data.

People, habits and reporting

Risk : The person who receives the trap message can neither spot it nor say who to tell.

  1. 19Have the teams been trained on phishing in the last twelve months?

  2. 20Do they know who to report a suspicious message or behaviour to?

  3. 21Is someone who reports their own mistake treated without blame?

  4. 22Are usage rules (personal devices, USB keys, file sharing) written down?

  5. 23Does onboarding a new employee include a formal handover of access?

  6. 24Is business use of personal phones governed by a rule?

Warning sign — An employee who clicked a dubious link would rather keep quiet, for fear of being blamed.

Personal data and obligations

Risk : An obligation discovered only on the day of the incident.

  1. 25Does the company know what personal data it processes, and for what purposes?

  2. 26Is a record of processing activities kept up to date?

  3. 27Are the providers processing data on your behalf identified and covered by a contract?

  4. 28Are retention periods defined and actually applied?

  5. 29Would you know how to notify a data breach to the competent authority within the applicable deadline?

  6. 30Can an access or erasure request be handled without mobilising the whole company?

Warning sign — Nobody knows within what deadline, or to which authority, a data breach must be reported in the country where the company is established.

Email security and payment fraud

Risk : Diverted payments, identity spoofing, compromised accounts.

  1. 31Are SPF, DKIM and DMARC configured on the company domain?

  2. 32Are suspicious attachments and links filtered before they reach mailboxes?

  3. 33Does a change of bank details require verification through an independent channel?

  4. 34Are unusual sign-ins and auto-forwarding rules to external addresses monitored?

  5. 35Are the recovery options of administrator accounts (phone, backup address) protected?

  6. 36Does confidential information travel only through tools the company controls?

Warning sign — A change of bank details can be approved on the strength of an email alone, with no independent phone verification.

Network and remote access

Risk : Intrusion into the information system, then unobstructed spread.

  1. 37Are routers, switches and Wi-Fi access points inventoried and kept up to date?

  2. 38Do you know which company services are reachable from the internet?

  3. 39Are admin interfaces and remote desktops closed to the open internet?

  4. 40Do remote connections go through a secured access, limited to authorised people?

  5. 41Is the guest Wi-Fi separated from the internal network?

  6. 42Do providers have individual access, time-limited and revocable?

Warning sign — A provider holds permanent access to the whole network, with no control and no audit trail.

Privileges and administrator accounts

Risk : Full takeover of the information system.

  1. 43Do administrators use a dedicated account for sensitive operations, separate from their everyday account?

  2. 44Does each person hold only the rights their role requires?

  3. 45Is the list of privileged accounts known and reviewed regularly?

  4. 46Do technical accounts (applications, scripts, automations) have limited rights?

  5. 47Are technical passwords, SSH keys and API tokens kept in a vault rather than in a shared file or a code repository?

  6. 48Can a sensitive administrative operation be attributed to a specific person?

Warning sign — Every employee holds local administrator rights on their machine, with no justification.

Business continuity and recovery

Risk : Being unable to work for hours, days or weeks.

  1. 49Are the applications the business cannot run without identified?

  2. 50Do you know what happens if the internet, the phone system, the main server or the management software stops?

  3. 51Is there a written procedure for keeping essential operations going in degraded mode?

  4. 52Are the steps for bringing systems back into service documented?

  5. 53Are the acceptable downtime and the acceptable data loss expressed as numbers?

  6. 54Has a major-failure scenario ever been rehearsed, at least on paper?

Warning sign — The company has backups, but nobody knows in what order to bring systems back up, or how long that takes.

Monitoring, detection and logging

Risk : An intrusion stays invisible until the damage becomes visible.

  1. 55Are you alerted when a server or a service becomes unavailable?

  2. 56Are unusual sign-ins and repeated authentication attempts detected?

  3. 57Are important logs centralised in one place?

  4. 58Are they kept long enough to reconstruct an incident?

  5. 59Is one person accountable for analysing and resolving alerts?

  6. 60Are unusual variations (traffic, sensitive changes, repeated failures) visible?

Warning sign — The company owns security tools, but nobody reads the alerts they produce.

Control over providers and dependencies

Risk : Dependence on a single provider, loss of access, inability to get your data back.

  1. 61Do the admin accounts for the domain name, hosting and email belong to the company?

  2. 62Can you revoke a provider’s access without depending on that provider?

  3. 63Are essential configurations documented and available internally?

  4. 64Could you retrieve your data and migrate to another provider?

  5. 65Do contracts spell out security, backup, availability and support obligations?

  6. 66Could you recover essential access if your provider disappeared tomorrow?

Warning sign — The IT provider is the only one who knows the admin passwords, and the domain name is registered in their name.

Costs and IT assets

Risk : Wasted spend, forced renewals, misdirected investment.

  1. 67Is the list of software and subscriptions the company pays for known?

  2. 68Are licences still billed for people who left or tools that were dropped?

  3. 69Are hosting, storage and compute costs tracked?

  4. 70Are contract end dates and automatic renewals recorded?

  5. 71Do you avoid paying for several tools that do the same job?

  6. 72Is hardware renewal planned rather than forced by a breakdown?

Warning sign — The director knows neither the total of their IT spend nor the list of tools it pays for.

Data, sharing and cloud

Risk : Data leakage, loss of control, accidental exposure of confidential information.

  1. 73Do you know where customer files, HR documents, contracts and financial data are stored?

  2. 74Are external share links limited to the people concerned, and in time?

  3. 75Are storage spaces attached to business accounts the company controls?

  4. 76Are sensitive folders separated from spaces every employee can reach?

  5. 77Is sensitive data encrypted in transit and at rest?

  6. 78Do essential documents stay available if a cloud provider becomes unavailable?

Warning sign — A share link set to "anyone with the link" still opens a customer folder created two years ago.

AI usage and governance

Risk : Disclosure of confidential information, wrong decisions, uncontrolled automations.

  1. 79Are the AI tools the teams use identified?

  2. 80Does a written rule state what must never be handed to an AI assistant?

  3. 81Are AI tools used with business accounts the company controls?

  4. 82Have the providers' data processing and retention terms been checked?

  5. 83Do AI agents hold only the rights their function requires?

  6. 84Do sensitive actions — payments, data deletion, external messages — go through human validation?

  7. 85Are the agents' important actions and decisions logged?

  8. 86Is there a way to stop an automation that starts behaving abnormally?

Warning sign — An AI agent can change business data or write to customers with no limit on its rights and no suitable control.

Incident response and readiness

Risk : An attack turns into a crisis for want of knowing what to do.

  1. 87Do the teams know who to contact when they spot suspicious activity?

  2. 88Is it clear who decides on emergency measures, including at night and at weekends?

  3. 89Do the competent people know how to isolate a compromised machine without making things worse?

  4. 90Can the logs and evidence useful for investigation be preserved?

  5. 91Are the contact details of providers, insurer and authorities available outside the information system?

  6. 92Are the notification obligations applicable to your country and activity identified?

  7. 93Is there a procedure to check systems are safe before putting them back into service?

Warning sign — Faced with ransomware, nobody knows whether to cut the network, call the provider or notify the insurer.

Your result

—%

Answer the questions above to see your result.

0 / 93 answered · 0 blind spots

Have it reviewed, free of charge

Your answers stay in this browser. Nothing is sent unless you paste your report into the contact form yourself.

Score by domain

Frequently asked questions

Is this self-audit free, and does it require signing up?

It is free and requires nothing: no sign-up, no email, no account. The questions are plain HTML, the scoring runs in your browser, and your answers are stored only in that browser. Nothing reaches Trustiatis unless you choose to paste your report into the contact form.

How long does it take?

Count fifteen to twenty-five minutes for the 93 questions across 15 domains. You can stop at any point: your answers are kept locally, so you can come back and finish later on the same browser.

Does a good score prove we are compliant?

No. This is a declared self-assessment, not an audit: it tells you where to look, not what is true. Compliance with GDPR, NIS2 or any other framework is established on evidence — configurations, logs, contracts, restore tests — which a questionnaire cannot inspect.

Why does "I don’t know" count as zero?

Because a control nobody can report on is not being managed. In practice, the number of "I don’t know" answers is the most useful figure in the whole result: it measures how much of your own system is outside anyone’s sight.

What happens if we ask Trustiatis to review the result?

You paste your report into the contact form and we come back with a reading of it: what is urgent, what can wait, what we would verify on the evidence. That review is free and commits you to nothing.

Related reading

Have your result reviewed

Paste your report into the form: we send back a reading of it — what is urgent, what can wait, what we would verify on the evidence. Free, no commitment.

Send my reportSee our method