Is multi-factor sign-in required for all company email accounts?
Yes · Partly · No · Not sure
What they’ll ask for
The sign-in policy for company email accounts, with its exceptions.
SECURITY SNAPSHOT
Review your security practices.
Answer 26 questions about your security practices and get suggested next steps. About fifteen minutes. This self-check is based on your answers; it is not an audit and does not test systems or verify your answers. Your answers stay in memory on this page and are discarded when you leave.
No account or email required. Answers are not sent to Piton or saved on your device.
Public domain settings
Check your company’s public DNS, email and web settings.
Check a domain you’re responsible for. We look only at public settings. How this check handles data.
Security review checklist
Use this printable checklist to discuss the controls and collect evidence. Enable JavaScript for the scored self-check.
Access
Is multi-factor sign-in required for all cloud consoles?
Yes · Partly · No · Not sure
What they’ll ask for
The sign-in policy for cloud consoles, with its exceptions.
Is multi-factor sign-in required for all administrator accounts?
Yes · Partly · No · Not sure
What they’ll ask for
The sign-in policy for administrator accounts, with its exceptions.
When someone leaves, is their access removed everywhere within one business day?
Yes · Partly · No · Not sure
What they’ll ask for
The offboarding checklist and two recent leavers with timestamps.
Resilience
Have you restored a critical system from backup in the last 12 months?
Yes · Partly · No · Not sure
What they’ll ask for
A restore test record with the date, system and time taken.
Is at least one backup copy protected from deletion by an attacker?
Yes · Partly · No · Not sure
What they’ll ask for
The backup isolation or immutability settings and the accounts that can change them.
Are critical security updates applied within 30 days on company laptops?
Yes · Partly · No · Not sure
What they’ll ask for
The update deadline and a current compliance report for company laptops.
Are critical security updates applied within 30 days on company-managed servers?
Yes · Partly · No · Not sure
What they’ll ask for
The update deadline and a current compliance report for company-managed servers.
Are critical security updates applied within 30 days on cloud services your team maintains?
Yes · Partly · No · Not sure
What they’ll ask for
The update deadline and a current compliance report for cloud services your team maintains.
Are all company laptops centrally managed?
Yes · Partly · No · Not sure
What they’ll ask for
The laptop inventory and device-management enrolment report.
Is disk encryption enabled on all company laptops?
Yes · Partly · No · Not sure
What they’ll ask for
An encryption-status report covering the laptop inventory.
Is endpoint protection running on all company laptops?
Yes · Partly · No · Not sure
What they’ll ask for
An endpoint-protection coverage report showing active devices.
Detection
Are sign-in and administrator activity logs kept centrally for at least 90 days?
Yes · Partly · No · Not sure
What they’ll ask for
The account activity log sources and their central retention settings.
Is a named person responsible for responding to security alerts?
Yes · Partly · No · Not sure
What they’ll ask for
The alert routing settings and the assigned response owner.
Do you have a written incident response plan?
Yes · Partly · No · Not sure
What they’ll ask for
The current written incident response plan.
Is a named person authorized to make decisions during a security incident?
Yes · Partly · No · Not sure
What they’ll ask for
The assigned incident decision-maker and their documented authority.
Has your team rehearsed its incident response in the last 12 months?
Yes · Partly · No · Not sure
What they’ll ask for
The date and notes of the most recent incident exercise.
Governance
Does one named person own security decisions?
Yes · Partly · No · Not sure
What they’ll ask for
The security owner’s name, role and assigned authority.
Are security decisions reported regularly to leadership?
Yes · Partly · No · Not sure
What they’ll ask for
The reporting schedule and the most recent security report to leadership.
Have your security policies been approved in the last 12 months?
Yes · Partly · No · Not sure
What they’ll ask for
The policy set with its approval dates.
Do your security policies match what your company actually does?
Yes · Partly · No · Not sure
What they’ll ask for
A review of policy commitments against current practice, with any exceptions.
Do you keep a list of vendors that hold company or customer data?
Yes · Partly · No · Not sure
What they’ll ask for
The vendor inventory showing which data each vendor holds.
Do you review a vendor’s security before signing a contract?
Yes · Partly · No · Not sure
What they’ll ask for
The pre-contract review process and a completed vendor security review.
Customer trust
Do you have written rules for which AI tools may use customer data?
Yes · Partly · No · Not sure
What they’ll ask for
The AI use policy identifying approved tools and allowed customer data.
Do you keep a list of AI features shipped in your product?
Yes · Partly · No · Not sure
What they’ll ask for
The shipped AI feature inventory, including data flows or confirmation of no AI features.
If a customer asked for evidence behind these answers this week, could you produce it?
Yes · Partly · No · Not sure
What they’ll ask for
Dated evidence supporting the answers, starting with the critical controls.
Discuss the checklist with contact@pitonsecurity.com.
This is a planning aid, not an audit, penetration test, certification, legal advice or guarantee.