Three questions that come first
Who has access?
And who approves it? Former staff and old suppliers tend to stay on the list.
What do your settings show?
Your website and email settings say a lot, and they can say less than you'd think.
What's next?
What should you ask your IT provider to look into?
Why email is often the first thing to look at
Your domain is your name online. If anyone can send mail that seems to come from it, your customers can be fooled by a fake invoice from "you". SPF, DKIM and DMARC are the settings that help prevent this, and they're often only half finished.
You can check your own with our guide: how to set up DMARC, step by step.
Working with your IT provider
We're not here to replace them, or to catch them out. Findings and evidence questions can be discussed with your designated IT provider, so that the person who can change a setting hears exactly what the question is.
- Findings say what was seen and what wasn't
- Questions go to the person who can answer them
- You decide what happens next
Questions from businesses
Where should a business start with cybersecurity?
Start by finding out who has access to what: your domain, mailboxes, website and outside platforms. Then check that MFA is required, and that accounts are removed when people leave.
We have an IT provider. Why would we need this?
A good IT provider is an advantage, and the review is built to work with them. It gives you an independent view of the evidence and a clear list of questions, so you can decide together.
Does this make us NIS2 or GDPR compliant?
No. The review doesn't certify anything. It shows what the evidence says and what remains unknown, which you can use in your own compliance work.
