A business owner can feel confident about cybersecurity because the company has antivirus, cloud accounts, and a backup subscription. But confidence is not the same as evidence that those safeguards work.
A cybersecurity study published by Clutch on October 6, 2026 surveyed 562 U.S. small-business owners who had previously experienced a cyberattack. Among those respondents, 95% reported feeling prepared before an incident. The findings highlight an important distinction: believing your business is protected is not the same as demonstrating that your security measures work.
The surveyed population matters: these were owners who had already been through an attack, so the results describe experienced businesses rather than all U.S. small businesses. Even so, the gap between perceived readiness and demonstrated readiness is a useful warning. A business can feel prepared and still suffer an incident. The question is whether it can show, with evidence, that it can prevent common problems, detect unusual activity, recover important operations, and respond quickly.
This five-step self-assessment is designed to help Connecticut business owners and decision-makers look past general assurances and examine what is actually in place. For each step, look for a recent record, test result, or named owner, not just a policy or a product on a bill.
Security confidence is a belief. Readiness is something you can demonstrate.
How to use this self-assessment
For each step, mark your business green, yellow, or red:
- Green: The process is documented, someone owns it, and you can show recent evidence that it works.
- Yellow: Some protection exists, but coverage, ownership, or testing is incomplete.
- Red: You do not know the answer, or the process has never been verified.
An honest “I don’t know” is useful. It identifies a question to resolve; it is not proof of a failure. The goal is to discover where confidence is based on a tested process and where it rests on assumptions.
1. Can you find vulnerabilities, and show that they get fixed?
A vulnerability scan looks for known weaknesses in systems and devices. Patch management is the work of prioritizing and applying fixes. Both matter, but a scan alone does not make a business safer. A report that no one reviews or acts on is just a list of unanswered questions.
Start with the basics: Do you have a current inventory of business computers, servers, network equipment, cloud services, and software? Can you identify which devices are exposed to the internet, who is responsible for updates, and which products are no longer supported?
Then look for evidence of a complete cycle:
- Identify: A scan or other assessment checks systems on a defined schedule.
- Prioritize: Findings are ranked by severity, exposure, business impact, and whether attackers are actively exploiting the weakness.
- Remediate: Someone applies a patch, changes a configuration, replaces an unsupported system, or documents why a fix is delayed.
- Verify: A follow-up check confirms the change resolved the issue.
Not every vulnerability requires an emergency response. But internet-facing systems, business-critical devices, and flaws known to be exploited deserve prompt attention. CISA’s Known Exploited Vulnerabilities Catalog is one authoritative source for identifying flaws attackers are actively using. CISA also publishes cybersecurity advisories with information on current threats and mitigations.
Patch coverage includes more than desktop computers. Routers, firewalls, remote-access tools, business applications, and third-party software can all need updates. Microsoft’s Windows 10 end-of-support announcement is a practical example: standard support for Windows 10 ended on October 14, 2025. Qualifying devices can continue receiving security updates through Microsoft’s Extended Security Updates (ESU) program, and some specialized Windows 10 editions follow different support timelines. A Windows 10 device enrolled in ESU is still receiving security updates; one without ESU or another supported update arrangement is not. In 2026, a business that still relies on Windows 10 devices should be able to explain how each one is protected, upgraded, replaced, or covered by a supported update arrangement.
For a useful vulnerability scanning check, ask your IT lead or provider:
- When was the last scan, and what systems did it cover?
- Which high-priority findings remain open, and why?
- Can you see evidence that resolved findings were checked again?
- Are any important systems outside the normal patch process?
FoxPowerIT describes its vulnerability assessment and security audit services as part of its security work. Whatever tools or provider you use, the key measure is not the number of scans. It is whether you know what needs attention and can track it through to resolution.
Green: You have a current inventory, regular scans, a prioritized remediation list, and follow-up evidence.
Yellow: Scanning or patching happens, but coverage or follow-through is unclear.
Red: You cannot say what is exposed, what is out of date, or who is responsible for fixing it.
2. Do you know what normal looks like on your network?
Security tools can produce alerts, but an alert is only useful when someone can judge whether it matters. That takes a working understanding of what normal activity looks like across the business.
Normal may include staff signing in from Connecticut during business hours, a scheduled cloud backup running overnight, or a particular server communicating with a known service. A sudden login from an unusual location, an unexpected administrator account, or a device sending large amounts of data outside the company may warrant investigation.
The point is not to treat every unusual event as an attack. Businesses have legitimate changes: employees travel, software updates, and new devices join the network. The goal is to notice meaningful departures from routine and have a defined way to check them.
Assess your network monitoring process by asking:
- What systems, devices, and accounts generate logs or alerts?
- Who reviews alerts, and how often?
- Which events are escalated immediately?
- Can the person investigating an alert see relevant information from the network, devices, and accounts?
- What happens after hours, on weekends, or when the usual contact is unavailable?
Monitoring without ownership can create noise. A dashboard that no one checks, or alerts that are routinely ignored, does not provide dependable visibility. CISA’s guidance on using logging on business systems explains why event records help organizations investigate unusual activity. Logging is most useful when records are protected, available when needed, and reviewed by someone with clear responsibilities.
Try a simple exercise: choose a typical business day and describe what normal activity looks like for a few important systems. Who signs in? Which services communicate? What routine tasks run after hours? If no one can answer, it will be harder to distinguish an ordinary change from something that requires attention.
FoxPowerIT offers remote monitoring and network monitoring and VLAN configuration. The specific service model matters less than the outcome: a named person should be responsible for seeing, interpreting, and escalating relevant signals.
Green: Your organization has monitoring coverage, a person reviewing meaningful alerts, and a clear escalation path.
Yellow: Some alerts exist, but you are unsure who sees them or what happens next.
Red: You would likely learn about suspicious activity from a user, vendor, or customer after it had already caused disruption.
Monitoring turns “something might be wrong” into “we noticed this, here is what we did.”
3. Can you restore the data and systems your business depends on?
A backup plan should answer more than “Do we back up?” It should show what is backed up, how quickly the business needs it back, and whether the restore process has been tested.
Start by identifying what the company cannot operate without. That may include customer and financial records, email, shared files, payroll information, business applications, system configurations, or operational databases. Different data has different importance. A file that can be recreated next week does not have the same recovery priority as the system needed to process orders tomorrow morning.
For each essential system, agree on two practical targets:
- Recovery point: How much recent work could the business afford to lose?
- Recovery time: How long could the business function without the system?
These are business decisions, not just technical settings. If you do not know the answers, ask the people responsible for serving customers, paying employees, or completing essential work.
Next, verify that backups cover the information you identified. CISA’s business data backup guidance recommends taking inventory, using a consistent backup approach, and testing recovery. It also points to the familiar 3-2-1 principle: keep three copies of important data, on two types of storage, with one copy stored off-site. The important self-assessment question is whether the arrangement meets your business’s needs, not whether the backup product has a long feature list.
Coverage is not the same as protection. Attackers who obtain administrative access may attempt to delete or encrypt backups they can reach, which is why immutable, offline, or appropriately isolated backup copies are recommended where practical. Verify that your backups are protected against unauthorized deletion, that restoration works as expected, and that coverage matches the systems you identified.
Testing should involve actual recovery, not just checking that a job completed successfully. Choose a file, mailbox, or system that matters and practice restoring it to a safe location. Confirm the restored information opens, is complete enough to use, and can be accessed by the people who need it. For larger systems, test a more substantial recovery scenario on a planned schedule.
A useful test records:
- What was restored and when
- How long the restore took
- Whether the data was complete and usable
- What permissions or approvals were needed
- Any steps that were unclear, slow, or missing
Also ask whether employees know how to access recovery instructions if the normal network or internet connection is unavailable. A process that exists only in a document stored on a system you cannot reach may not help during an outage.
Green: Critical data and systems are identified, recovery expectations are agreed on, and restores are tested and documented.
Yellow: Backups run, but you have not tested enough systems or confirmed that recovery meets business needs.
Red: You cannot identify what is covered, how long recovery might take, or who would perform it.
4. Are employees prepared to recognize and report phishing?
Security tools cannot make every decision for employees. A realistic security awareness program helps people notice suspicious messages and gives them a clear, low-friction way to report them.
Effective security awareness training should reflect the work people actually do. A finance employee might receive a message asking to change payment instructions. A business owner might get an urgent request that appears to come from a vendor. A staff member could see a familiar name attached to an unexpected document or sign-in prompt. Training should help employees pause, verify through a trusted channel, and report the message rather than guess.
A short annual module may cover the basics, but readiness also depends on what happens between formal sessions. Consider how the business:
- Explains common warning signs, such as unexpected urgency or requests for credentials.
- Gives staff a simple way to report a suspicious email or message.
- Responds to reports without shaming employees for asking.
- Reminds staff to confirm sensitive payment or account changes using a known contact method.
- Teaches employees what to do if they have clicked a link or entered information.
A report is an opportunity to act. When an employee flags a suspicious message, someone should know how to assess it and whether other people need to be warned. Employees should also know that reporting quickly is better than trying to hide a mistake or investigate a suspicious message themselves.
One measure of resilience is not simply how many people pass a quiz. It is how quickly a suspicious message reaches the right person, whether employees know how to report it, and whether the business learns from patterns in reported messages.
CISA’s guidance on teaching employees to avoid phishing offers practical advice for small businesses. The goal is to build a habit of checking and reporting, not to expect every employee to become a security expert.
One terminology note can prevent confusion when reviewing sign-in practices: a one-time code generated by an authenticator app is generally a possession factor under NIST’s digital identity guidance (SP 800-63B). It demonstrates access to the device or app holding the secret. The code is not, by itself, proof that the user’s account is safe from phishing. Keep this distinction in mind when discussing employee training and account protection.
That awareness should be backed by multifactor authentication (MFA). Require MFA on Microsoft 365, business email, cloud services, remote-access systems, and administrative accounts. MFA significantly reduces the risk that a stolen password alone leads to an account compromise, but it does not eliminate phishing. Where practical, use phishing-resistant methods such as FIDO2 security keys or passkeys, which NIST identifies as resistant to these attacks.
Green: Staff receive recurring, role-relevant guidance and know exactly how to report a suspicious message or accidental click.
Yellow: Training happens, but reporting, follow-up, or real-world practice is inconsistent.
Red: Employees are expected to “use common sense,” but have no clear route to raise a concern.
5. Does everyone know what to do, and who to call?
When a security incident is suspected, people should not have to invent a plan while the business is under pressure. A written incident response plan helps staff know who makes decisions, who investigates, how the business communicates, and what steps to take to limit damage.
A practical plan should include:
- A primary and backup incident coordinator
- Current contact details for your IT provider and other essential technical support
- A way to reach key people if company email or phones are unavailable
- The person authorized to make business decisions during an incident
- How employees report suspected incidents
- Who communicates with customers, suppliers, staff, and other relevant parties
- Where response notes and key records are kept
- How the business will prioritize restoring essential operations
A plan should not tell every employee to take technical actions beyond their role. It should give them simple first steps: report the issue promptly, stop interacting with a suspicious message, and follow instructions from the designated response lead. The people handling the incident can decide how to investigate and contain it.
Keep a printed or otherwise separately accessible contact list. Include phone numbers, not only email addresses. Confirm that the list is current and that the relevant people know they are on it. If a provider or key employee has changed, update the plan.
Then rehearse. A short tabletop exercise can reveal gaps without interrupting business operations. For example, imagine an employee reports that an important shared system is unavailable and unusual files have appeared. Ask: Who gets the first call? Who can authorize technical work? How will the business keep serving customers? What if email is unavailable? Where will updates be recorded?
CISA encourages small businesses to prepare and practice an incident response plan through its small-business cyber guidance and tabletop exercise resources. A short conversation can expose outdated contacts, unclear authority, or a recovery dependency the business had not considered.
Green: The plan has named owners, current contacts, offline access, and has been discussed or exercised recently.
Yellow: A plan or contact list exists, but it is outdated, incomplete, or untested.
Red: People would have to decide whom to call and what to do during the incident itself.
What your results mean
The five steps are not a certification, and a green answer does not guarantee that an attack will never succeed. The purpose is to replace vague confidence with specific evidence and to make the next improvement easier to choose.
- Mostly green: Preserve the evidence, review it on a schedule, and make sure a staff change or new technology does not leave a gap.
- A mix of green and yellow: Pick the yellow area with the greatest effect on business continuity or customer service. Give it an owner and a target date.
- One or more red areas: Start by identifying what is unknown. A current asset list, a tested restore, or an up-to-date incident contact sheet can provide a practical first step.
For each item, write down three things: the owner, the evidence, and the next review date. That small record can turn “we think we’re prepared” into a process that can be checked and improved.
For Connecticut organizations comparing providers or strengthening internal operations, this is also a useful way to frame a conversation about IT support for small businesses in Connecticut. FoxPowerIT’s broader managed IT services include security, infrastructure, data protection, maintenance, and support; the right approach for any company depends on its systems and business needs.
If you are unsure how to interpret one of your results, asking a trusted IT professional or an independent outside adviser for a second opinion can help clarify what evidence to gather next. Start with the result that would most disrupt your business if it failed.
Preparedness isn’t a feeling. It’s a set of tested answers to “What happens next?”