Question 1 of 14: Are all devices running operating systems that receive regular security updates from the vendor (no Windows 7, 8 or 10, unsupported Android versions, etc.)?💡 Hint ▼
Windows: Settings > System > About (avoid Windows 7/8)macOS: Apple Menu > About This Mac (avoid macOS older than 11)iOS: Settings > General > About (avoid iOS older than 15)Android: Settings > About Phone (avoid Android older than 10)
Question 2 of 14: Are critical security updates installed within 14 days of release, or do you have automatic updates enabled?💡 Hint ▼
Windows: Settings > Update & Security > Windows UpdatemacOS: System Preferences > Software UpdateiOS: Settings > General > Software UpdateAndroid: Settings > System > System Update
Question 3 of 14: Is anti-virus / anti-malware protection installed and kept up to date on all devices?💡 Hint ▼
Windows: Windows Defender (built-in) counts! Check Windows Security in SettingsmacOS: Built-in XProtect provides basic protectioniOS/Android: Have built-in protectionHeimdal or Huntress for advanced business protection.
Question 4 of 14: Do you have firewalls protecting your network AND software firewalls enabled on all devices?💡 Hint ▼
Your router has a built-in firewall. Windows also has Windows Defender Firewall (check Windows Security settings).
Question 5 of 14: Have your firewall/router settings been checked and default passwords changed in the last 12 months?💡 Hint ▼
Default router passwords are often "admin/admin" or printed on the router label. These should be changed to something unique.
Question 6 of 14: Does every staff member have their own unique login (no shared accounts)?💡 Hint ▼
Site foremen, office staff, and apprentices should all have separate logins. No sharing the "office computer password" with everyone!
Question 7 of 14: Are staff accounts disabled immediately when someone leaves?💡 Hint ▼
When a subcontractor finishes or staff leave, cut their digital access immediately - email, file access, everything. Like changing locks!
Question 8 of 14: Do staff only have access to the systems and files they need for their role?💡 Hint ▼
Apprentices shouldn't see financial files. Site managers don't need access to payroll. Office admin shouldn't access project costings.
Question 9 of 14: Is Multi-Factor Authentication (MFA) enabled on ALL cloud services that support it (not just Microsoft 365 or Google Workspace)?💡 Hint ▼
Enable 2-step verification on business email, cloud storage, banking, supplier portals - anywhere you store quotes, contracts, or financial data.
Question 10 of 14: Do you enforce strong password requirements (12+ characters OR 8+ characters with common password blocking)?💡 Hint ▼
Strong: "BuildSafe2024!" or "HammerTime99!". Weak: "password", "builder123", your company name. Mix letters, numbers, symbols.
Question 11 of 14: Are all devices set to lock automatically with a PIN, password or biometric login?💡 Hint ▼
Laptops should lock after 15 minutes idle. Phones should require PIN/fingerprint. No staying logged in!
Question 12 of 14: Have you disabled automatic file execution (auto-run) and removed unused software from all devices?💡 Hint ▼
When you plug in a USB stick, it shouldn't auto-run programs. Also uninstall old software you don't use - less risk!
Question 13 of 14: Are external services (email, remote access, etc.) protected by MFA or strong password controls?💡 Hint ▼
If you can access your email or systems from outside the office, they need extra protection like 2-factor authentication.
Question 14 of 14: Do you have a clear process to reset passwords quickly if an account is compromised?💡 Hint ▼
If someone's account gets hacked, you need a plan: who to call, how to reset passwords, what steps to take. Write it down!
