Business Security Score
How well protected is your business, really? Answer 24 plain-language questions, matched to the NIST Cybersecurity Framework, and find out where you stand.
- Step 1: 24 plain questionsAbout 5 to 7 minutes, one at a time. Pick what really happens today.
- Step 2: Your grade and what to fix firstScored on the six NIST functions, with the essential controls flagged.
- Step 3: A plan and a PDF to keepFree, with no signup.
Answers are scored in your browser and saved there so you can come back. We only receive your email and answers if you choose to email yourself the report.
Set the rulesGovern
ImproveKnow what you haveIdentify
Rough guideLock things downProtect
StrongSpot trouble earlyDetect
ImproveAct when it happensRespond
ImproveGet back upRecover
Improve
Good
Solid base, a few gaps to close.
Fix first: Write a one-page recovery list: what to restore first, who does it and who to call
How scoring works
Each question describes four ways a business might handle one control. You pick the closest to what happens today, and these are the rules the tool applies.
Each answer
- 0Not in place, or you are not sure
- 1Informal or partial
- 2In place, with room to tighten
- 3Fully in place and kept current
With 24 questions the maximum is 72 points. Each topic area and each NIST function is rated on its own: at or below 33% is Needs attention, up to 66% is Needs improvement, and above that is Well managed.
Overall grade
- AStrong · 90% and above
- BGood · 70% to 89%
- CFair · 50% to 69%
- DNeeds Work · 30% to 49%
- FGetting Started · Below 30%
How the questions map to NIST CSF 2.0
The NIST Cybersecurity Framework 2.0 groups security work into six functions. Every question here is tagged with one of them, in plain words, so a non-technical reader can follow the same structure that larger organizations use.
- Set the rulesGovernDecide who is responsible for security, write down the rules, and check how it is going.3 questions
- Know what you haveIdentifyKeep track of your devices, software, accounts and data, so nothing important is forgotten.1 question
- Lock things downProtectPut safeguards in place: strong sign-in, updates, backups, protected networks and trained staff.14 questions
- Spot trouble earlyDetectNotice that something is wrong quickly, through alerts, monitoring and staff who speak up.2 questions
- Act when it happensRespondKnow who does what, and who to call, when something goes wrong.2 questions
- Get back upRecoverRestore your data and systems, get back to work, and learn from what happened.2 questions
The counts differ on purpose. Most of the everyday controls a small business can act on, such as sign-in, updates, backups and training, sit under Protect, so it has the most questions. A function with a single question is shown as a rough guide, without a verdict.
This is a self-assessment aligned to the framework. It is not an official NIST assessment, and it is not a compliance check. Read the source material: NIST CSF 2.0 and the Small Business Quick-Start Guide (SP 1300).
One rule keeps the grade honest
Averages can hide a serious hole. If multi-factor authentication covers little beyond email, critical data has no reliable automated backup, or company computers have no managed protection, the grade cannot be higher than C. Your percentage is still shown in full.
It is only as accurate as your answers: a way to find the next few things to fix, not an audit or a guarantee.
Security Score FAQ
How the score works, what happens to your answers and what it leaves out
Frequently asked questions
How long does the assessment take?
About 5 to 7 minutes. There are 24 questions across 6 topic areas, shown one at a time. You can go back and change an answer at any point, and your progress is kept in this browser if you need to leave and come back.
What does the score measure?
How many of the basic security controls are in place at your business today, across identity and access, network and remote access, backup, endpoint protection, email and phishing defense, and governance. Each question is scored from 0 to 3 for a maximum of 72 points. Every question also belongs to one of the six NIST Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond and Recover), so your results show both views and where the gaps are.
See how scoring worksWhy is my grade lower than my percentage suggests?
A few controls matter too much to be averaged away: multi-factor authentication, reliable backups and managed protection on company computers. If one of them is missing, the overall grade is held at C even when the rest of your score is high. The results say so and show which control caused it.
Is my data stored or shared, and do I need to give an email?
No email is needed. Your answers are scored and saved in your browser, they are not sent to us while you take the assessment, and downloading the PDF sends nothing. If you choose to email yourself the report, we receive your email address, your optional company name and your answers so we can build and send it. Ticking the follow-up box is separate and optional, and only means we may get in touch about your results.
Read our privacy policyIs this a security audit or a compliance check?
No. It is a self-assessment based on your own answers, so it is a good starting point for planning rather than proof of security. The questions are aligned to the NIST Cybersecurity Framework (CSF) 2.0 and your results are shown by its six functions, but this is not an official NIST assessment, NIST has not reviewed or endorsed it, and it does not certify compliance with any framework.
Read the security assessment guideHow are the recommendations chosen, and are they paid placements?
Each answer maps to one specific action, and nothing is added for a question you answered fully. Tool suggestions appear only where an answer shows a gap those tools address. Some links go to products through affiliate partnerships, and we may earn a commission at no extra cost to you. They are marked Sponsored and sit beside our own reviews, and your score and the gaps flagged do not depend on them.
Read our affiliate disclosureRelated tools and guides
- Email Health CheckTest your domain’s SPF, DKIM and DMARC in seconds.
- Office IT PlannerPlan the network, WiFi and backup for a small office.
- Small business security assessment guideHow to evaluate your security posture step by step.
- Security audit checklistA checklist for a regular review of your setup.
More free checks live in our tools library.
Want help acting on your results?
If you would rather have an IT team handle the fixes, our Miami team can walk through your report and help with the first few. No pressure: the plan is yours to keep either way.
Or call us: (305) 741-4601