// Free Assessment

How mature is your IT?

Answer 24 questions across six critical areas. Takes about 5 minutes. At the end, you'll see exactly where your company stands and where the gaps are.

24 questions · 6 categories · ~5 minutes

Category 1 of 6

// 01

IT Strategy & Governance

Does your company have a documented IT strategy or technology roadmap?

No — IT decisions are made ad hoc as needs come upInformally — someone has a general idea but nothing writtenPartially — there's a document but it's outdated or not followedYes — a current roadmap reviewed regularly with leadership

Who is accountable for IT decisions at the leadership level?

Nobody specifically — it falls to whoever is availableAn operations lead or office manager handles IT alongside other dutiesAn MSP or external vendor manages most IT decisionsA dedicated IT leader or partner who reports to executive leadership

Do you have documented IT policies (acceptable use, data handling, device management)?

No formal policies existA few informal rules but nothing documentedSome policies exist but aren't consistently enforcedComprehensive policies documented, communicated, and enforced

How is your IT budget managed?

There is no IT budget — expenses are approved as they come upA rough annual number exists but isn't tracked closelyA defined budget with some tracking but limited forecastingA structured budget with quarterly reviews, forecasting, and cost optimization

1 / 6

Category 2 of 6

// 02

Cybersecurity & Risk

Is multi-factor authentication (MFA) enforced for all users?

No — passwords onlyAvailable but optional — some users have it, some don'tRequired for most users but not all apps or admin accountsEnforced across all users, admin accounts, and critical applications

What happens when an employee leaves the company?

No formal process — accounts may stay active for weeks or longerSomeone manually disables accounts but there's no checklistA basic checklist exists but device and data recovery is inconsistentA documented offboarding process covering accounts, devices, data, and access within 24 hours

Do you have endpoint protection and monitoring on all company devices?

No — or just basic consumer antivirusBusiness antivirus installed but not centrally managedManaged endpoint protection but limited monitoring or responseEDR/MDR with active monitoring, alerting, and incident response

Has your company tested its response to a phishing or security incident?

Never — and we don't have an incident response planWe've had incidents but handled them on the flyA basic incident response plan exists but hasn't been testedDocumented IR plan with regular testing or phishing simulations

2 / 6

Category 3 of 6

// 03

Cloud & Identity

Where does your company's email and productivity suite live?

Mix of personal accounts, free tools, or on-prem serversCloud email but not fully configured or securedM365 or Google Workspace with basic setup but limited security policiesFully configured cloud platform with security policies, DLP, and compliance controls

How is user identity managed (who has access to what)?

Shared logins or individual accounts with no central directoryCloud directory but apps aren't integrated with itCentral identity provider with SSO for some appsUnified identity with SSO, conditional access, and role-based permissions

Are company devices enrolled in a management platform (MDM/Intune)?

No — employees use personal or unmanaged devicesCompany-owned devices but no central managementMDM enrolled but policies are basic or inconsistentFully managed with compliance policies, encryption, and remote wipe

How would you describe your cloud migration status?

Still mostly on-premises with no migration planPartially migrated — some cloud, some on-prem, no clear strategyMostly cloud with a few legacy systems remainingCloud-first or fully cloud-native with documented architecture

3 / 6

Category 4 of 6

// 04

Infrastructure & Networking

Do you have a documented backup and disaster recovery plan?

No backups or an ad hoc approachSome backups running but no documented recovery planRegular backups with a basic recovery plan but untestedDefined RTO/RPO targets, automated backups, and tested recovery

What does your network security architecture look like?

Consumer-grade router/firewall with default settingsBusiness firewall in place but minimal segmentationManaged firewall with VPN and basic network segmentationNext-gen firewall with zero-trust segmentation and monitored traffic

How do you handle server and system updates/patching?

Manually, when someone remembers — or not at allAutomatic updates enabled but not monitoredScheduled patching with some monitoring but gaps existCentrally managed patch policy with compliance reporting

What's the age and condition of your core IT infrastructure?

Unknown — some equipment is 5+ years old with no refresh planMix of old and new with no lifecycle trackingMost infrastructure is current but no formal refresh cycleDocumented asset inventory with a defined lifecycle and refresh plan

4 / 6

Category 5 of 6

// 05

Vendor & Budget Management

Do you know exactly how many SaaS tools your company pays for?

No — tools get added and nobody tracks themRoughly, but there's probably overlap and unused licensesWe have a list but haven't audited usage recentlyFull inventory with usage tracking and regular optimization

When was the last time you reviewed or renegotiated a vendor contract?

Never — contracts auto-renew and nobody reviews themWhen a vendor raised prices and forced the conversationOccasionally, but it's not a regular practiceContracts are reviewed before renewal with negotiation

If you use an MSP, how would you describe the relationship?

No MSP and no one owns IT vendor relationshipsWe have an MSP but aren't sure what we're gettingThe MSP handles tickets but doesn't contribute to strategyClear SLAs, regular reporting, and accountability on our side

How do new software purchases get approved?

Anyone can sign up for anything with a credit cardLoosely — managers approve but there's no formal processApproval required but security isn't always evaluatedFormal procurement with security review and budget alignment

5 / 6

Category 6 of 6

// 06

AI Readiness

Is your team currently using AI tools (ChatGPT, Copilot, etc.) for work?

Not that we know ofSome people are probably using free tools on their ownWe've licensed a tool but haven't set guidelinesLicensed tools with clear usage guidelines and governance

Does your company have an AI acceptable use policy?

No — we haven't discussed AI governanceInformally — verbal guidance but nothing writtenA draft policy exists but hasn't been rolled outPublished policy covering data handling and approved tools

How concerned is leadership about data being shared with AI platforms?

It hasn't come upSome concern but no action takenConcerned — discussed but no controls implementedActive controls — tenant restrictions, DLP, approved-tool-only

Does your company have a strategy for how AI will be used?

No — we're not thinking about AI yetCurious but no planExploring use cases but no formal roadmapDefined strategy with use cases, budget, and executive sponsorship

6 / 6

// Your Results

0/ 72

Where to focus first

Want to talk through these results?

I review these assessments personally. Reach out for a 30-minute conversation about what your scores mean and where to start.

Get in Touch