Question 1 of 8
Do employees receive phishing-specific awareness training at least annually?
Question 2 of 8
Have you run simulated phishing campaigns against staff in the past 12 months?
Question 3 of 8
Is multi-factor authentication (MFA) enforced on all email and business-critical accounts?
Question 4 of 8
Do you have email authentication (SPF, DKIM, DMARC) properly configured on your domain?
Question 5 of 8
Is there a clear, well-known process for employees to report suspicious emails?
Question 6 of 8
Do you have email filtering or an anti-phishing gateway in place?
Question 7 of 8
Has your organization had a successful phishing incident (stolen credentials, malware, fraud) in the past 12 months?
Question 8 of 8
Do new employees receive security awareness training during onboarding, before getting system access?