Cybersecurity self-assessment for small businesses

Prepare the information

Involve someone who knows the systems and someone who makes business decisions. If IT is outsourced, confirm relevant answers with the provider rather than guessing.

• List services and tools needed to operate.
• Identify who manages access, maintenance and backups.
• Identify suppliers with access to data or systems.
• Gather available incident communication and recovery procedures.

Start a free DTS assessment

Create or claim the company profile and begin the assessment for free. Confirm that you represent the organisation and answer progressively. Ask the responsible person when information is missing.

While the assessment is open, an available score is provisional. The questionnaire describes the situation; it is not an exam where the goal is to obtain the highest number.

Turn findings into tasks

Review missing information and measures needing attention. Assign each improvement an owner, a checkable outcome and a review date. Prioritise according to business impact.

For example, if you do not know whether a backup can be restored, confirm or arrange an authorised recovery test and record the result. Ticking a box does not resolve that uncertainty.

Compare progress in context

Use indicators to discuss priorities. Check whether scope, tier or status has changed before comparing scores. A provisional number must not be presented as a verified assessment.

INCIBE also offers a self-assessment that starts with how a business uses technology. Its results and DTS should not be treated as equivalent scales.

Frequently asked questions