Good. That suggests your provider is monitoring beyond basic antivirus. It is still worth confirming exactly what parts of your environment are being watched. Strong coverage usually includes email, cloud services, credentials, and unusual account activity in addition to the computers themselves.

If your business is only relying on basic antivirus, there are likely parts of your environment that are not being actively watched. Email accounts, cloud services, passwords, and unusual user activity are common entry points for attacks. Without broader monitoring, suspicious activity in those areas can be missed.

If you are not sure what is being monitored, it will be difficult to know how much of your environment is actually covered. Strong security monitoring usually includes email, cloud services, credentials, and unusual account activity in addition to the computers themselves.

Good. That suggests your provider is watching for signs that an account may be compromised. It is worth knowing which accounts are covered and whether that monitoring includes exposed credentials, unusual sign-ins, and other suspicious account activity.

Since you answered no, this may be an area of exposure. Stolen usernames and passwords can be used without triggering traditional antivirus, and compromised credentials can circulate for some time before anyone notices. Monitoring gives your business a better chance of catching that activity earlier.

If you are not sure, it is worth finding out. Stolen or exposed credentials can give an attacker access without anything looking obviously wrong at first. Your provider should be able to tell you whether they monitor for this activity and which accounts are covered.

Your answer indicates MFA is being centrally managed and required across critical accounts and systems. That is a strong safeguard, but it is still worth confirming there are no gaps in coverage. One unprotected admin, email, remote access, or cloud account can become the weak point attackers use to get in.

Since you answered No, MFA is not being consistently required and centrally managed across your critical accounts and systems. That creates openings where a stolen password may be enough to gain access.

If you are not sure, this is worth checking. MFA is most effective when it is required consistently across critical systems and managed in one place, rather than left up to individual users or enabled only on certain accounts.

Great! It sounds like your employees are getting regular practice recognizing phishing and social engineering attempts. That is valuable because attackers often rely on people to open the door for them. It is still worth knowing how often employees are tested and whether the training changes based on the results.

Without regular testing and training, employees are more likely to miss the warning signs of phishing and social engineering, fall behind on newer attack tactics, and leave your business less prepared for cyber insurance requirements. Since you answered no, this is an area worth addressing.

If you are not sure, treat that as a gap. Phishing tactics change constantly, and employees who are not being tested and trained regularly can become an easy entry point for attackers. It can also create problems when cyber insurance applications ask how your business handles security awareness training.

Since you answered yes, your backups are getting human verification in addition to automated monitoring. That adds an important layer of accountability because backup alerts can be missed, fail, or report success when something is still wrong.

If no one is regularly verifying your backups, your business is relying entirely on automation to catch problems. That can leave failures unnoticed until the day you actually need to restore data, which is the worst time to discover the backup was incomplete or unusable.

If you are not sure, find out. A backup is only useful if it can actually be restored, and automated alerts alone do not prove that. Human verification helps catch failed jobs, incomplete backups, and other issues before they turn into a recovery problem.

A YES here means missed updates are being actively followed up on instead of being left to automation alone. That reduces the chance that failed or delayed patches quietly leave systems exposed.

If patching is left entirely to automation, failed updates can sit unnoticed for weeks or longer. That leaves known security weaknesses open even though a fix already exists, creating an avoidable path into the business.

If you are not sure, this is worth checking. Automated patching is useful, but it does not guarantee every update installs successfully. Someone should be reviewing failures and making sure missed updates are actually resolved.

It sounds like your provider is looking for risks before they turn into problems. The next question is how thorough those reviews really are. Regular audits should cover more than obvious issues and should lead to documented findings, clear priorities, and follow-through on what needs to be fixed.

A NO here means your environment may only be getting attention when something breaks or becomes obvious. Without regular audits and vulnerability scans, outdated systems, weak configurations, and exposed services can sit unnoticed until they create downtime, security issues, or problems during an insurance or compliance review.

If you are not sure, that is worth clarifying. Your provider should be able to tell you how often your environment is audited, what is included in those reviews, and how identified risks are tracked and resolved. If they cannot explain that clearly, you may not be getting the proactive oversight you expect.

Your provider appears to have a defined response plan in place. The important part is whether that plan is documented, tested, and clear enough to use under pressure. You should know who takes the lead, how incidents are contained, and what happens next if a real attack occurs.

A business relying on improvisation during a cyber incident can face slower containment, confusion over responsibilities, and greater damage while people figure out what to do. A documented response process gives your team and provider a clear path when time matters most.

If you are not sure, that is a serious question to resolve. Your provider should be able to show you the process they would follow during a cyber incident, who is responsible for each step, and how they would contain the threat and get your business operating again.

Your answer indicates that your provider is helping connect your security program to the requirements your business may actually be held to. It is still worth confirming that this review happens regularly and that changes in your insurance application, industry requirements, or technology environment are reflected in the controls they recommend.

If your provider is not helping with this, your business may be paying for security tools without knowing whether they support your cyber insurance or compliance obligations. That can create surprises during a claim, renewal, audit, or assessment when specific controls are expected.

If you are not sure, this is worth clarifying. Your provider should be able to explain how your current security controls line up with the requirements that apply to your business and identify where gaps still exist.

Your answer suggests your provider is looking ahead instead of waiting for problems to force action. That is a strong sign, but the real value is in the depth of those reviews. They should lead to clear recommendations around risk, performance, lifecycle, security, business priorities, and long-term technology strategy. Anything less can leave your business spending reactively, carrying avoidable risk, and missing opportunities to use technology more efficiently.

Without proactive reviews, important risks and opportunities can sit unnoticed until they become urgent. That often leads to rushed technology decisions, avoidable downtime, unnecessary spending, and aging systems staying in place longer than they should. Your provider should be helping you plan ahead so technology supports the business instead of becoming an expensive reaction to problems.

If you are not sure, that may mean these conversations are not happening in a meaningful way. Your provider should be regularly helping you identify risks, plan for upcoming technology needs, and connect IT decisions to your business strategy. Without that, you may be spending reactively and missing opportunities to reduce costs, improve efficiency, or avoid problems before they become expensive.

GET YOUR RESULTS Enter your information to view your score and get your 10 Questions Every Business Should Ask Their IT Provider.