ZEKASTRA

Planning

Self-assessment

Answer a short set of questions about accounts, devices, backups and habits, and get a list of what to do first. It helps you decide where to start; it is not a score.

This is a self-assessment, not an audit or a certification. It cannot see your accounts or devices; it only reflects your answers, and the lists show where an answer points to a gap, not how secure you are. Your answers stay in this browser, on this device, and are never sent to ZEKASTRA or anyone else.

Choose who the questions are for

Go to your lists ↓

Choose Partly when something is done for some accounts, devices or people but not all. Choose Not sure when you do not know; it is treated like No.

For yourself and your family

14 questions. Answer for the accounts and devices you and your family actually use, as they are today.

Accounts

Is multi-factor authentication turned on for your main e-mail account and your bank?

Why it matters: Whoever controls your e-mail can reset the password of nearly everything else, and with a second step a stolen password alone is not enough.

Does each of your accounts have its own password, kept in a password manager?

Why it matters: A password reused on one site that leaks is the usual way a person's other accounts get opened.

Are the recovery e-mail, phone number and backup codes of your main accounts current and stored safely?

Why it matters: Recovery details are how you get back in after a loss, and how a criminal gets in if they point to an address you no longer control.

In the last year, have you looked at which devices are signed in and which apps can reach your accounts?

Why it matters: Old sessions and forgotten app permissions stay open long after you stop using them.

Devices

Are automatic updates turned on for your phone, computer, browser and apps?

Why it matters: Most attacks on ordinary users rely on flaws for which a fix already exists.

Do your phone and computer lock the screen with a PIN or password, and is their storage encrypted?

Why it matters: A lost or stolen device without a lock hands over the mail, photos and saved logins on it.

Do you install apps only from the official store and remove the ones you do not use?

Why it matters: Apps from unofficial sources are a common way to get malware onto a phone.

Do you know how to find, lock or wipe your phone from another device if it is lost?

Why it matters: Location and remote-wipe features only help if they were turned on before the loss.

Backups

Are your photos and documents backed up somewhere other than the device itself, and have you tried restoring from that backup?

Why it matters: A backup you have never restored may turn out to be empty, and one that is always connected can be encrypted together with the files by ransomware.

Messages and scams

When a message about money, a parcel or your account asks you to act quickly, do you check it in the official app or on a phone number you already had?

Why it matters: Urgency is the one thing nearly all phishing messages have in common, and the link or number in the message belongs to the sender.

Do you know what to do in the first minutes if you pay or sign in on a fake page?

Why it matters: The first hours decide whether a bank can still stop a payment and whether an account can be recovered.

Home network

Have you changed the default administrator password on your router and kept its firmware up to date?

Why it matters: The router is the front door for everything at home, and the default passwords of many models are public.

Do visitors and smart-home devices use a separate guest network?

Why it matters: A cheap camera or TV with weak security then cannot reach your computers and phones.

Family

Have you agreed a simple rule at home, with children and older relatives included, for calls and messages that ask for money or codes?

Why it matters: Fraud often targets the person in the household who is least on guard, and a short rule agreed in advance protects them.

For a small organisation

18 questions. Answer for the whole organisation as it is today, not for how it should be. If you are unsure, ask whoever looks after IT.

The CIS number next to a question is the top-level control of CIS Controls v8.1 that it fits. It shows where the question belongs, not that you meet the control.

Accounts and access

Is multi-factor authentication required for e-mail, remote access, accounting and administrator accounts?

Why it matters: Stolen or guessed passwords are a common way in, and a second step means a password on its own is not enough.

Does each person have their own account, and are administrator rights kept apart from everyday work?

Why it matters: When one account does everything, a single stolen password or one wrong click gives access to the whole system.

Is access removed on the day someone leaves or changes role?

Why it matters: Accounts of former staff are rarely watched, and they stay valid until someone closes them.

Does the team use a password manager, so that business accounts have unique passwords and shared logins are not passed around by chat or e-mail?

Why it matters: Passwords sent in messages stay in mailboxes and chat histories, and reused passwords turn one leak into many.

Devices and updates

Are updates applied within days, not months, on computers, servers, firewalls and VPN devices?

Why it matters: Attackers scan the internet for devices with a known flaw, and devices facing the internet, such as firewalls and VPN gateways, are tried first.

Do you keep a current list of devices, software and accounts, and of where customer data is stored?

Why it matters: You cannot update, back up or secure what you do not know you have.

Do company computers and phones have a screen lock and disk encryption, and do people work with standard user accounts?

Why it matters: A lost laptop is a data leak unless its disk is encrypted, and a standard account limits what malware can change.

Is malware protection active on every computer and kept up to date?

Why it matters: Built-in or commercial protection catches known malware that a person did not recognise.

Does your e-mail service filter spam and dangerous attachments, and are SPF, DKIM and DMARC set up for your domain?

Why it matters: Filtering stops many messages before anyone sees them, and the three records make it harder to send mail that pretends to come from your domain.

People and money

In the last year, have staff had a short session on phishing and fake invoices?

Why it matters: Staff who have seen real examples know what to stop and check before they click or pay.

Does everyone know whom to tell, straight away and without blame, if they clicked or opened something suspicious?

Why it matters: The damage from a click grows with every hour it goes unreported, and people hide a mistake they expect to be blamed for.

Are changes of supplier bank details and unusual payment requests confirmed by phone, on a number you already had, and approved by a second person?

Why it matters: Payment fraud works through a convincing e-mail with a new account number; a call to a number you already had breaks it.

Data, suppliers and website

Do you know which personal data you hold, where it is kept, and what the data-protection law requires if it leaks?

Why it matters: A leak of personal data can carry a duty to notify the authority within 72 hours, and you cannot meet it without knowing what you hold.

Do you know which outside providers (hosting, accounting software, IT support) can reach your data, and how to contact their security teams?

Why it matters: A breach at a supplier becomes your breach, and at that moment you need a contact, not a search.

If you run a website, are its platform and plugins kept updated and its administration area protected with multi-factor authentication? (If you do not run one, answer Yes.)

Why it matters: Outdated plugins and weak administrator logins are a common way a small website is taken over.

Recovery and response

Are business backups kept offline or with version history, and has a restore been tested in the last six months?

Why it matters: Ransomware also encrypts backups that stay connected, and you only know a backup works once you have restored from it.

Is there a one-page incident plan that says who decides, who is called and what is isolated first?

Why it matters: During an incident there is no time to settle roles; a plan written in advance saves the first hour.

Are sign-in and administrator activity logs for e-mail, cloud and key systems kept long enough to look back?

Why it matters: After a compromise, the logs show what happened and when; without them you are guessing what was touched.