How exposed is your business, really?

1. Do your employees have a written information security policy they've actually read?

   Yes Somewhat — it exists, but it's outdated or unread No

2. If a client or vendor asked for a SOC 2 report, HIPAA attestation, or security questionnaire tomorrow, could you produce one?

   Yes Not sure No

3. Do you have a written policy for how employees can use AI tools (ChatGPT, Claude, Copilot, etc.) at work?

   Yes Informally, but nothing written No

4. Is a specific person or team responsible for reviewing vendor risk before new contracts are signed?

   Yes Sometimes, informally No

5. If an employee's laptop were lost tomorrow, would you know exactly what data was on it and whether it was encrypted?

   Yes Not sure No

6. Have you reviewed which state privacy laws (like CCPA) apply to your business in the last 12 months?

   Yes Not sure which apply to us No

7. Does leadership receive regular (at least quarterly) reporting on security and compliance risk?

   Yes Occasionally Never

8. If you had a data breach today, do you have a written incident response plan you could follow?

   Yes Not sure No

Please answer all 8 questions to see your results.