Risk Assessment Tool

Find out what cyber risks your business is exposed to, and receive a Tailored Action Plan to help deal with them.

Take 10 minutes to find out what cyber risks your business faces

Receive an Action Plan tailored to your business to help improve your cyber resilience

Make your business more resilient to cyber attack

Risk assessment

Are you the only employee in your business? (e.g., sole trader or limited company)

Risk Assessment Consent(Required)

Please tick here to indicate your consent.

I have read the information sheet entitled “Information for Participants: Risk Assessment Tool for SMEs” provided.
I understand I can contact cyber-resilience@cyberskills.ie to ask questions about the purpose and nature of the research study.
I understand that I have the right to refuse to participate, refuse to answer any question and withdraw up to the point of data analysis without any consequence.
I understand that the answers I give will be collected by the research team and used in their study.
I understand my data will be used in the development of the Risk Assessment Tool and it is planned to publish the anonymous findings in an academic journal.
I consent voluntarily to be a participant in this research study.

This field is hidden when viewing the form

Are you the only employee in your business? (e.g., sole trader or limited company)(Required)

Yes

What sector does your business operate in?(Required)

Who is responsible for the cybersecurity of your business?(Required)

No one

Myself

An outsourced person/team

Other

What is the outsourced person/team responsible for?

IT only

Cybersecurity only

IT and Cybersecurity

I’m not sure

Has someone been assigned the responsibility of maintaining network security to ensure there is no unauthorised access or usage? (E.g., maintenance of network firewalls)

Yes

I don’t know

Do you have cyber insurance?

Yes

Not sure

Does your business currently meet the minimum cybersecurity requirements for your cyber insurance policy?

Yes

I don’t know

Does your business rely on a Social Media Platform (such as Facebook or Instagram) to sell your products and/or services?

Yes

Can customers make purchases on your website?

Yes

I have a website but customers cannot make purchases on it

I do not have a website

How do you take payments on your website?

We process card details directly

We use a third party payment provider (such as Stripe, PayPal, Apple Pay, Google Pay)

We have a combination of the first two answers

I’m not sure

Does your business currently comply with Payment Card Industry (PCI) standards?

Yes

I don’t know

Is the cybersecurity of your Business Website managed by a suitably qualified person on an ongoing basis?

Yes

I don’t know

Is your website backed up?

Yes

Not sure

Do you have an inventory of all of your digital hardware used for your business? (e.g., a documented list of all computers, mobile phones etc that are used in any capacity (emails etc) for your business)

Yes, I maintain a comprehensive inventory and update it regularly

Somewhat, I have some documentation but it may not be up-to-date

No, I don’t have a clear inventory of our digital hardware

Do you have an inventory of all the software used for your business? (such as Microsoft 365, Google Docs etc)

Yes, I maintain a comprehensive inventory and update it regularly

Somewhat, I have some documentation but it may not be up-to-date

No, I don’t have a clear inventory of our digital software

Do you use your own personal device (mobile phone, computer, etc) for the business? (e.g., accessing files, emails etc)

Yes

Do you have full access to business files when using your personal device?

Yes

I’m not sure

Do you use a VPN when working remotely?

Yes

I don’t know what a VPN is

We don’t work remotely

Do you have antivirus and/or endpoint management on your devices?

Yes, on all devices

Yes, on some devices

No, not on any devices

Not sure

Are work devices wiped of all data when they are no longer being used for the business?

Yes

I have not needed to do this yet

I’m not sure

How do you keep the software on your devices up to date?

I manually update all our software

I have automatic updates enabled for all our software

All software is updated regularly – using either manual or automated updates

Some but not all of our software is regularly updated

We have an outsourced third party who updates our software

Our software is not regularly updated

I’m not sure

What type of data does your business collect? Tick all that apply:

Personal data (emails, names, phone numbers)

Sensitive data (health-related data, data regarding customers race/ethnicity/sexual orientation)

Intellectual Property data (business sensitive data such as product design documents, recipes, etc)

I collect data but I am not sure what type

I do not collect data

Other

What type of data does your business collect?: Other

Are you aware of your obligations under GDPR to report a personal data breach to the data Protection Commissioner within 72 hours of becoming aware of the breach?

Yes, I knew this already

I did not know this until now

Where do you store the data that you collect? Tick all that apply:

In the Cloud (e.g., Microsoft 365, CRM or Finance Software)

On a work computer

On mobile devices

On paper

I don’t know

Not applicable

Other

Where do you store the data that you collect?: Other

Do you have a backup for your data that is stored in the Cloud?

Yes, I pay for a dedicated cloud backup service

Yes, I download and back up the data locally

I’m not sure

I don’t store data in Cloud

Do you encrypt the data that you store? (for example, do you keep the data in a file that is password protected)

Yes, I encrypt all data

Yes, I encrypt some data

No, I don’t encrypt any data

I’m not sure

Do you process customer payments over the phone?

Yes

How do you manage this data (the customers card numbers)?

The data is inputted directly into the payment device and is not written or stored anywhere

The data is stored in an encrypted file (e.g., password protected)

On paper

On a work computer

I’m not sure

Other

Do you share business data with any Third Parties (e.g., delivery drivers not directly hired by you, marketing agencies, or outsourced IT personnel)?

Yes, they get full access to my systems

Yes, they get access to my systems but only as much as they need to complete their job

Yes, I share data but I do not give Third Parties direct access to my systems (e.g. data is shared via email or Excel files)

How do you schedule data backups for critical data?

I have automated backups scheduled.

I perform manual backups

Some of my backups are automated and some are manual

I don’t have a formal data backup process in place

How often do you complete a critical data back up?

Daily

Weekly

Monthly

Yearly

Ad hoc

I’m not sure

Do you have immutable or air gapped backups for your business's critical data? (Immutable means 'read only'. Air gapped means having no direct connection to the internet or to any other computer that is connected to the internet).

Yes, for all backups

Yes, for some backups

I’m not sure

Are your data backups tested? (this is where you check to see if you can recover your data)

Yes they are tested monthly

Yes they are tested annually

Yes they are tested twice a year

Yes but I have only tested them once

I’m not sure

Do you have Multi Factor Authentication (MFA)

Yes for all business critical applications

Yes for some business critical applications

Not sure

Do your passwords have a minimum length of at least 16 characters?

Yes

Not sure

Do you use a Password Manager? (an app that stores all of your passwords)

Yes for all my passwords

Yes for some of my passwords

Not sure

Do you enforce block listing passwords? (this is where certain passwords are not allowed as they are too easy to guess)

Yes

Not sure

How often do you engage with cybersecurity training? 

Weekly

Monthly

Yearly

Ad Hoc

Never

Would you know what to do if a cyber incident occurs?

Yes, there is a plan in place

Not sure

Have you tested your incident response plan?

Yes, it is tested regularly and updated

Yes, once

No, it has never been tested

Do you have a business continuity plan (BCP) in place? (A BCP is a documented plan for how to prevent and recover from potential threats to a company such as fire, flood, cyber-attack).

Yes, and it is regularly tested, reviewed and updated

Yes, but it has only been tested once

Yes, but it has never been tested

Is your cyber incident plan integrated into your Business Continuity Plan (BCP)?

Yes

Not sure

Do you have a cybersecurity policy for your business?

Yes, I have a documented cybersecurity policy in place

Yes, I have a policy but it is not documented

I’m not sure

This field is for validation purposes and should be left unchanged.

Risk Assessment Consent(Required)

Please tick here to indicate your consent.

This field is hidden when viewing the form

Are you the only employee in your business? (e.g., sole trader or limited company)

Yes

How many employees are in your business? (including yourself and all part time and full time staff)(Required)

What sector does your business operate in?(Required)

Who is responsible for the cybersecurity of your business?

Myself

Dedicated cybersecurity person/team in house

An outsourced person/team

Managed by employee(s) on top of their official role(s)

No one

Other

Who is responsible for the cybersecurity of your business?: Other

What are the dedicated person/team responsible for?

IT only

Cybersecurity only

IT and cybersecurity

I’m not sure

What is the outsourced person/team responsible for?

IT only

Cybersecurity only

IT and Cybersecurity

I’m not sure

Has someone been been assigned the responsibility of maintaining network security? (E.g. cybersecurity of routers, ports and/or maintenence of network firewalls)

Yes

I don’t know

Do you have cyber insurance?

Yes

Not sure

Does your business currently meet the minimum cybersecurity requirements for your cyber insurance policy?

Yes

I don’t know

Does your business rely on a Social Media Platform (such as Facebook or Instagram) to sell your products and/or services?

Yes

Can customers make purchases on your website?

Yes

I have a website but customers cannot make purchases on it

I do not have a website

How do you take payments on your website?

We process card details directly

We use a third party payment provider (such as Stripe, PayPal, Apple Pay, Google Pay)

We have a combination of the first two answers

I’m not sure

Does your business currently comply with Payment Card Industry (PCI) standards?

Yes

I don’t know

Is the cybersecurity of your business website managed by a suitably qualified person on an ongoing basis?

Yes

I don’t know

Is your website backed up?

Yes

I don’t know

Do you have an inventory of the digital hardware used in your business – a document that lists all your business computers, mobile phones, printers, routers, etc.?

Yes, we maintain a comprehensive inventory and update it regularly.

Somewhat, we have a hardware inventory but it may not be up-to-date

No, we don’t have a clear inventory of our digital hardware

Do you have an inventory of all the software used in your business? (such as Microsoft 365, Google Docs, Accounting Software, Sales Software, etc.)

Yes, we maintain a comprehensive inventory and update it regularly.

Somewhat, we have a software inventory but it may not be up-to-date

No, we don’t have a clear inventory of the software used in our business.

Do you or members of staff use personal devices (mobile phones, computers etc.) for work purposes?

Yes

I’m not sure

Do you or members of staff have access to business files when using personal devices?

Yes

I’m not sure

Do you and your staff use a VPN when working remotely?

Yes

I don’t know what a VPN is

We don’t work remotely

Do you have antivirus and/or endpoint management on your devices?

Yes, on all devices

Yes, on some devices

No, not on any devices

Not sure

Are work devices wiped of all data when they are no longer being used for the business?

Yes

I have not needed to do this yet

I’m not sure

How do you keep the software on your devices up to date?

We manually update all our software

We have automatic updates enabled for all our software

All software is updated regularly – using either manual or automated updates

Some but not all of our software is regularly updated

We have an outsourced third party who updates our software

Our software is not regularly updated

I’m not sure

What type of data does your business collect? Tick all that apply:

Personal data (emails, names, phone numbers)

Sensitive data (health-related data, data regarding customers race/ethnicity/sexual orientation)

Intellectual Property data (business sensitive data such as product design documents, recipes, etc)

We collect data but I am not sure what type

We do not collect data

Other

What type of data does your business collect? Tick all that apply: Other

Are you aware of your obligations under GDPR to report a personal data breach to the Data Protection Commission within 72 hours of becoming aware of the breach?

Yes, I knew this already

I did not know this until now

Where do you store the data that you collect? Tick all that apply:

In the Cloud (e.g., Microsoft 365, CRM or Finance Software)

On a work computer

On mobile devices

On paper

I don’t know

Not applicable

Other

Where do you store the data that you collect?: Other

Do you have a backup for your data that is stored in the Cloud?

Yes, I pay for a dedicated cloud backup service

Yes, I download and back up the data locally

I’m not sure

I don’t store data in Cloud

Do you encrypt the data that you store? (for example, do you keep the data in a file that is password protected)

Yes, I encrypt all data

Yes, I encrypt some data

No, I don’t encrypt any data

I’m not sure

Do you process customer payments over the phone?

Yes

How do you manage this data (the customers' card numbers)?

The data is inputted directly into the payment device and is not written or stored anywhere

The data is stored in an encrypted file (e.g., password protected)

On paper

On a work computer

I’m not sure

Other

Do you grant access to your business system to any Third Parties (e.g., delivery drivers not directly hired by you, marketing agencies, or outsourced IT personnel)?

Yes, they get full access to our systems

Yes, they get access to our systems but only as much as they need to complete their job

Yes, we share data but we do not give Third Parties direct access to our systems (e.g. our data is shared via email or Excel files)

How do you schedule data backups for critical data?

We have automated backups scheduled.

We perform manual backups

Some of our backups are automated and some are manual

We don’t have a formal data backup process in place

How often do you complete a critical data back up?

Daily

Weekly

Monthly

Yearly

Ad hoc

I’m not sure

Do you have immutable or air gapped backups for your businesses critical data? (Immutable means 'read only'. Air gapped means having no direct connection to the internet or to any other computer that is connected to the internet).

Yes for all backups

Yes for some backups

I’m not sure

Are your data backups tested? (this is where you check to see if you can recover your data)

Yes they are tested monthly

Yes they are tested annually

Yes they are tested twice a year

Yes but I have only tested them once

I’m not sure

Do you enforce access controls so that different users have different access rights?

Yes

I’m not sure

Do you have Multi-Factor Authentication (MFA) enabled?

Yes for all business critical applications

Yes for some business critical applications

Not sure

Do you or any of your employees share passwords with one another?

Yes, some passwords are shared

Yes, all passwords are shared

Do you require staff’s passwords to have a minimum length of at least 16 characters?

Yes

Not sure

Do you advise staff to use a password manager? (This is an app that stores all of your passwords)

Yes

Not sure

Do you enforce block listing passwords? (this is where certain passwords are not allowed as they are too easy to guess)

Yes

Not sure

How often do you and your employees engage with cybersecurity training?

Staff are required to engage with cybersecurity training once a month

Staff are required to engage with cybersecurity training once a year

Staff are informed about cybersecurity on an ad hoc basis, there is no formal training

Staff are required to engage with cybersecurity training upon hire, but not after that

Staff have never engaged with cybersecurity training

Are employees required to report any suspicious activities or cybersecurity incidents?

Yes, we have clear reporting procedures for cybersecurity incidents.

Somewhat, we encourage reporting but it’s not consistently enforced.

No, we don’t have specific reporting procedures in place.

Would you and your staff know what to do if a cyber incident occurs?

Yes there is a plan in place that all staff are aware of

Yes I have a plan in place but only some staff are aware

Yes I have a plan but no staff are aware

Not sure

Have you tested your Cyber Incident Response Plan?

Yes, it is tested regularly and updated

Yes, once

No, it has never been tested

Do you have a business continuity plan (BCP) in place? (A BCP is a documented plan for how to prevent and recover from potential threats to a company such as fire, flood, cyber-attack).

Yes, and it is regularly tested, reviewed and updated

Yes, but it has only been tested once

Yes, but it has never been tested

Is your cyber incident plan integrated into your Business Continuity Plan (BCP)?

Yes

Not sure

Do you have a cybersecurity policy for your business?

Yes, we have a documented cybersecurity policy in place

Yes, we have a policy but it is not documented

I’m not sure

Comments

This field is for validation purposes and should be left unchanged.