About your business
Annual revenue (USD) Used to pick the published loss range for firms your size.
Sector Manufacturing Public sector Healthcare Information Retail Financial Utilities Entertainment Other / not listed
Revenue per day that depends on IT (USD) What you would lose each day if your systems were down.
Days to restore after an attack Your best estimate of the quickest, the likely and the slowest recovery.
Readiness
Answer Yes only if it is true everywhere. Unanswered counts as No.
Do all remote access routes (VPN, remote desktop, cloud logins) need multi-factor authentication?
Why insurers ask: Stolen passwords are the most common way in; MFA on remote access stops most of them. See the tools
Do all administrator and privileged accounts need multi-factor authentication?
Why insurers ask: An attacker with an admin account can switch off defences and reach every system. See the tools
Does every email account need multi-factor authentication?
Why insurers ask: Email takeover leads to payment fraud and password resets for other services. See the tools
Is endpoint detection and response (EDR) running on every workstation and server?
Why insurers ask: EDR catches ransomware behaviour that ordinary antivirus misses; insurers ask for 100% coverage. See the tools
Do you filter email for phishing, malicious links and attachments with a dedicated email security tool?
Why insurers ask: Phishing is a leading way ransomware starts. See the tools
Are critical security patches installed within 14 days of release?
Why insurers ask: Attackers exploit known flaws within days; unpatched systems are a common entry point. See the tools
Do you control and record administrator access with a privileged access management (PAM) tool?
Why insurers ask: It limits what a stolen admin login can do and leaves an audit trail. See the tools
Do you use zero trust network access (ZTNA) or network access control (NAC) so unknown devices cannot reach internal systems?
Why insurers ask: It keeps an intruder on one device from roaming across the network. See the tools
Do staff take phishing awareness training at least once a year?
Why insurers ask: People are the target of most attacks; trained staff report more and click less. See the tools
Are backups of all critical systems immutable or kept offline, separate from the main network?
Why insurers ask: Ransomware deletes or encrypts reachable backups first; separate copies make recovery possible. See the tools
Does access to the backup system need multi-factor authentication?
Why insurers ask: Attackers who can log in to backups can wipe them. See the tools
Have you tested restoring from backups in the last 12 months?
Why insurers ask: An untested backup often fails; the test shows how many days of downtime to expect. See the tools
Do you have an incident response plan that you have rehearsed in the last 12 months?
Why insurers ask: Rehearsed teams contain incidents sooner, and sooner means cheaper. See the tools
Is someone watching your security alerts around the clock (an in-house SIEM team or a managed detection and response service)?
Why insurers ask: Many attacks run overnight and at weekends; round-the-clock monitoring shortens the time to spot them. See the tools
Is sensitive data encrypted, or protected by data loss prevention (DLP)?
Why insurers ask: Encrypted or controlled data is less costly to lose and easier to defend to regulators. See the tools
Recovery and continuity Optional. Leave everything blank to skip this section. Per-asset targets are in the asset rows above.
RTO (recovery time objective) : The longest outage the business can accept before the harm becomes unacceptable. Compare it with how long a restore really takes.RPO (recovery point objective) : The most data, measured in time, you can afford to lose. Backups taken less often than this break it.Cold, warm and hot disaster recovery : Cold: space and hardware, set up after a disaster. Warm: a scaled-down copy kept fairly current. Hot: a full copy that takes over within minutes.3-2-1 backups : Three copies of the data, on two different media, with one copy off-site (ideally immutable).BCP (business continuity plan) : A written plan for keeping critical processes running, or restoring them, during and after a disruption.Tabletop exercise : A talk-through of an incident, such as ransomware, where leaders say what they would decide and do.Recovery time objective, overall (hours) The longest outage you can accept.
Recovery point objective, overall (hours) The most data, in hours of work, you can afford to lose.
Backup interval (hours between backups) How often your backups run.
Cost to recreate one hour of lost data (USD) Your estimate; no public default.
Disaster recovery level None Cold Warm Hot None : No standby environment: you rebuild from backups after a disaster.Cold : Space and hardware are available but must be set up and loaded with data; recovery takes days.Warm : A scaled-down copy is running and kept fairly current; recovery takes hours.Hot : A full copy runs in parallel and takes over within minutes.Do you have a written business continuity plan (BCP)?
Do backups follow the 3-2-1 rule?
Months since the last BCP test Enter 0 or leave blank if never tested.
Months since the last disaster recovery test Enter 0 or leave blank if never tested.
Months since the last incident tabletop exercise Enter 0 or leave blank if never held.