The owner of a professional office rarely has time to read cybersecurity manuals. But they can answer simple questions about their own office. This office cybersecurity checklist is designed with that in mind: ten questions, yes/no answers, and a two-line explanation for each.
Why do it? According to the Cyber Index PMI 2025, the maturity index of Italian small and medium-sized enterprises in security matters stands at 55 out of 100: improving, but still far from a reassuring level. And around one in four small and medium-sized businesses has suffered at least one attack in the last three years.
How to use this self-assessment checklist
Take a pen and paper (or the notes app on your phone). For each question, mark Yes only if you are sure. If you cannot answer, mark No: not knowing is already important information.
The 10 questions
1. If a virus encrypted all your files tomorrow, do you know where you would recover them from?
You need at least one backup copy disconnected from the office network, recent and tested: in other words, someone has recently checked that the files can actually be restored. A backup that has never been tested is a hope, not a backup. → The 3-2-1 backup rule
2. Do your email and cloud software ask for a second code as well as the password?
Two-factor authentication (a code on your phone, an app or a physical key) is the single most effective measure against account theft. According to a 2023 Microsoft Research study, it reduces the risk of compromise by more than 99%. → Passwords, MFA and passkeys
3. Do your computers, smartphones and software update automatically?
Most attacks exploit flaws that are already known and already fixed by the manufacturers. If updates are postponed for weeks, the door stays open. This also applies to the router, the NAS and the printers.
4. Is there anything more than the provider’s router between the office network and the internet?
The router is there to connect you to the internet, not to protect the office. A firewall controls what comes in and what goes out and can alert you when something is wrong. → Why the router is not enough
5. If an office computer were infected tonight, would anyone know by tomorrow morning?
This is the most important question. Many incidents are discovered weeks later, when the data has already left. You need a system that watches and alerts a specific person, in a way they can understand.
6. Is the guest Wi-Fi separate from the one used by work computers?
Clients, suppliers and personal devices should never share the network with your practice management software and client documents. The same goes for cameras and “smart” devices. → Guest Wi-Fi and IoT devices
7. Do people working from home connect to the office through a VPN?
Remote control programs left permanently running and ports left open on the router are among attackers’ favourite ways in. A VPN creates an encrypted, controlled channel. → VPN and remote working
8. Would everyone in the office recognise a scam email, and do they know whom to report it to?
Phishing remains the most common way into an organisation: in the ENISA Threat Landscape 2025 report it is the entry point in around 60% of the cases analysed. With artificial intelligence, scam emails are better written than ever. → How to spot phishing
9. Is there a clear rule on what data may be entered into ChatGPT and other AI tools?
Pasting a contract or a tax return into a public chatbot can mean handing confidential data to third parties. You need a written rule that is short and shared with everyone. → Generative AI in the office without the risks
10. If you suffer an attack, do you know whom to call and in what order?
A sheet with three names and three numbers (technician, privacy consultant, insurer if you have one) and the steps to follow saves precious hours. Remember that, in the event of a personal data breach, the GDPR requires notification to the Italian Data Protection Authority (Garante) within 72 hours where the conditions apply. → Cyberattack: what to do
How to read your score
Count your Yes answers.
| Score | What it means | What to do |
|---|---|---|
| 9-10 | Good level of attention | Keep up the good habits and repeat the checklist every six months |
| 6-8 | The basics are there, but with gaps | Tackle the “no” answers starting with backup (1) and two-factor authentication (2) |
| 3-5 | Office exposed | Schedule a meeting with your technician within two weeks |
| 0-2 | High risk | Start straight away with backup, two-factor authentication and updates |
Where to start if you have many “no” answers?
Not everything carries the same weight. If you have to choose, the recommended order is:
- Disconnected, tested backup (question 1): it is what saves you when everything else has failed.
- Two-factor authentication on email (question 2): it takes a few minutes and blocks most account thefts.
- Automatic updates (question 3).
- Someone who watches and alerts you (questions 4 and 5).
- Everything else, one thing at a time.
ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale), has published practical advice for owners, employees and technicians of small and medium-sized businesses as part of its “Accendiamo la cybersicurezza” (“Let’s switch on cybersecurity”) campaign: it is an excellent complement to this list.
Are questions 4 and 5 the hardest? That is normal
Backup, two-factor authentication and updates can be sorted out with a one-off intervention. Knowing in real time what is happening on the network, on the other hand, requires someone (or something) watching every day. This is exactly the problem we are developing Strega Defence to address: a Box that protects the office network and an app that alerts you only when something that matters happens, explaining it in plain language: it blocks threats on its own, without leaving you technical decisions to make. Discover Strega Defence.
Frequently asked questions
How often should this checklist be repeated?
At least every six months, and in any case whenever something significant changes: new staff, new practice management software, an office move, a new internet provider or new devices on the network.
Can I fill it in without technical knowledge?
Yes, it is designed for the owner or the office manager. If you cannot answer a question, mark it as “no” and ask your trusted technician: their answer will also tell you a lot about how closely your office is being looked after.
Does this checklist replace a professional risk assessment?
No. It is a quick self-assessment to understand your priorities. A full risk assessment, which is also useful for GDPR purposes, requires a more in-depth analysis of the office’s data processing, systems and procedures.
What is the most important measure if I can only do one?
A backup disconnected from the network and verified with a restore test. It is the only measure that lets you get back on your feet even when an attack has succeeded.
Is a small office really a target for hackers?
Yes, because most attacks are automated and hit anyone with a weakness, without choosing the victim based on size. Offices also hold confidential data and often have fewer defences than large companies.
Sources and further reading
- Cyber Index PMI 2025 (in Italian) — Confindustria, Generali, Osservatori PoliMi, ACN, March 2026.
- ENISA Threat Landscape 2025 — ENISA, October 2025.
- How effective is multifactor authentication at deterring cyberattacks? — Microsoft Research, 2023.
- Accendiamo la cybersicurezza – consigli per le PMI (in Italian) — ACN, the Italian National Cybersecurity Agency.
- Consigli utili per dirigenti e titolari (PDF) (in Italian) — ACN.
- Data breach: notifica al Garante (in Italian) — Italian Data Protection Authority (Garante per la protezione dei dati personali).
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
