Free self-assessment · 5 minutes
Twelve questions. Five minutes. A real answer.
Most smaller organisations do not have a security problem they can name. They have a handful of gaps they have never had cause to look at together. This asks twelve questions across the eight areas where those gaps usually sit, and gives you a scored report at the end of it.
Who it is for
Any smaller organisation that wants to know where its everyday cybersecurity stands. It asks nothing about products you manufacture — if you build or resell connected hardware or software, the Cyber Resilience Act pages are the ones that fit.
What it covers — eight areas, twelve questions
- Governance and risk management
- People and process
- Identity and access management
- Asset and data management
- Protection
- Detection and response
- Resilience
- Generative AI use
One line worth saying out loud: the last of those is not decoration. Staff are already pasting company material into chatbots, and almost nobody has decided in writing what is allowed. If that is the area you came for, the AI usage assessment is twenty-one questions on it rather than one.
What you get
A six-page PDF. An overall score with a band, a radar chart across the eight areas with anything below 3.0 marked, a table of every area with its score, and a prioritised list of findings — each with what it is, why it matters and what to do, ordered so the first two or three account for most of the exposure.
Every question and the answer you gave is listed at the end with its score, so the result is never a number you have to take on trust.
What the report looks like
Three pages from a real report, generated by running the assessment.
How you scored 
What to address 
Your answers
Why so short
Because a long questionnaire that nobody finishes tells you nothing. Twelve questions is roughly the point where the answers stop changing the advice.
Where this usually leads: Cybersecurity for SMBs
The assessment starts below — you do not need to go anywhere else.
A few details first
We use these to prepare your report and, if you would like, to talk it through afterwards.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Yes, and finishing it does not trigger a sales call. Your answers produce your report; we hold them with your contact details so we can pick up where you left off if you ask us to. Nothing is published, shared or compared with anyone else's.
Accurate about the basics, which is all it claims. It will not find a misconfigured firewall rule or an exposed service. It reliably finds missing multi-factor authentication, untested backups and everyday administrator rights — and at this size those are what most incidents actually turn on.
Answer what is true today rather than what is planned. Every option maps to a score, and the honest middle answers are worth more to you than the flattering ones: a gap you know about is cheaper than a number you liked.
No. That is the point of a five-minute check — no documents, no inventory, no meeting to book. If a question needs someone else's knowledge, note it and answer from what you know; the report tells you which areas to go back to properly.
Probably not. Start with the Security Baseline: the same eight areas, forty-eight controls, and a harder question at each one — whether you do it consistently rather than whether you do it. It takes thirty-five minutes and produces findings at control level.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.