Resource

How do you know if your business is protected from a cyberattack?

Most business owners can't actually answer this question, not because they haven't thought about it, but because nobody has ever defined "protected" in a way they could check themselves.

You know your business is protected when you can show evidence: MFA on every account, security software installed and reporting on every device, patches current, backups that have actually been restored, and monitoring that would show when a problem started. If your IT provider can't show you those things, you don't know yet.

Dawn Sizer · CEO and Co-Founder, 3rd Element Consulting · Published August 17, 2026 · Updated September 28, 2026

Schedule an IT Environment Review

Check it yourself

Ask which accounts don't have MFA today. The right answer is none, including admin and shared accounts.
Ask which devices are missing security protection or are behind on patches right now.
Ask when you last restored from a backup, and how long it took.
Check that email security (SPF, DKIM, and DMARC) is set up for your domain.
Ask who has admin rights, and whether each person actually needs them.
Ask whether you have a written incident response plan that says who does what.
Ask whether your provider could show you when a problem started three weeks ago, and what changed.

If any answer is 'I'm not sure,' that's the place to start. Our IT Audit Readiness Checklist walks through all of it.

A checklist for whether your business is actually protected.

Most business owners have never been given a plain-language definition of what protection actually requires. Their IT provider says things are handled. Their cyber insurance renewal asks about controls they've never heard of. Nobody has laid out what "protected" looks like in terms they can verify themselves.

You can know. A business is protected when it can answer yes, with proof, to each of the following.

1. Multi-factor authentication is on everywhere it matters. Coverage includes email, remote access, financial systems, and administrative accounts.

2. Backups exist, and someone has actually tested restoring from them. An untested backup has never been verified.

3. Someone is watching for threats after hours. Monitoring and response coverage includes periods outside normal business hours.

4. There's a written, specific plan for the first 24 hours of an incident. Named steps and named people.

5. Old accounts and unused access get removed on a schedule. Every former employee or vendor with lingering access is an unlocked door.

6. Someone can show, in writing, what the current risk actually is. The documentation describes the current environment and its specific gaps in readable terms.

Answers supported only by a "probably" need further verification. Ask for evidence that each control is in place.

Security controls verified against a written standard

Why this is hard to self-assess.

Most IT support is built around responding to tickets. A provider can be responsive and fast and still never have tested backups or reviewed who has access to what. Ticket volume and actual security posture are two different things.

This is why the cyber insurance renewal conversation catches so many businesses off guard. The application asks for specifics, MFA coverage, endpoint detection, backup testing, and it becomes the first time anyone has actually verified the answers.

The six items, one at a time.

Backup testing is the one most often assumed and least often proven. A backup job that completes every night proves the job ran, not that the data comes back. A real test restores into a working environment, confirms the system boots and functions, and documents how long it took. That distinction is why backup is not the same as recovery, and it is covered in depth there.

After-hours monitoring is the second. Most intrusions start outside business hours because that's when nobody is looking. Monitoring that only means an alert landing in a dashboard until Monday morning is not monitoring. The question to ask is simple: at 2am on a Saturday, who sees the alert, and what are they authorized to do about it?

How 3rd Element verifies this.

Every new client relationship starts with an IT Environment Review, a direct look at the six items above, with documentation, so the business gets a written answer.

Protection is maintained against a standards baseline (CIS Controls), applied consistently to the environment, applied the same way regardless of contract tier.

Backup recovery gets tested on a schedule. Access gets reviewed on a schedule.

Schedule an IT Environment Review

Common questions

Questions leadership usually asks first.

How do I know if my business is protected from a cyberattack?

Look for evidence you can check: MFA on every account, protection and current patches on every device, backups that have been restored in a test, email security for your domain, limited admin rights, a written incident response plan, and monitoring history. If your provider can't show you these, you don't know yet.

Is my current IT provider responsible for cybersecurity, or is that separate?

It depends entirely on the contract, and this is one of the most common gaps businesses discover. Some MSPs treat security as a separate, optional add-on. At 3rd Element, cybersecurity controls, MFA, endpoint detection, monitoring, and backup, are part of the standard coverage layer for every client.

How do I know if my backups would actually work in a ransomware situation?

The only real way to know is a documented recovery test. If nobody has shown you a completed test with results, there isn't yet a real answer.

What's the difference between antivirus and real cybersecurity protection?

Antivirus catches known threats on a single device. Real protection includes monitoring across the whole environment, MFA, tested backups, access management, and a response plan, all working together.

Does a small business really need this level of protection?

Business size doesn't reduce the need, it changes the stakes. A 30-person company without tested backups and MFA is exposed the same way a 300-person company is, and the incident is just as disruptive relative to its size.

How do I find out what my actual gaps are without committing to anything?

An IT Environment Review is built for exactly this, a direct look at the current environment against the six-item checklist, so there's real information before deciding anything.

What is an IT Environment Review?

The IT Environment Review is free and takes about 30 minutes by video or phone. We ask a set list of questions about your environment, answer yours, and send you a written summary afterward.

Get a clearer view of your IT environment.

Find out what is working, where the risks are, and what needs attention next.

Schedule an IT Environment Review

How do you know if your business is protected from a cyberattack?

Check it yourself

A checklist for whether your business is actually protected.

Why this is hard to self-assess.

The six items, one at a time.

How 3rd Element verifies this.

Questions leadership usually asks first.

Related work and reading.

What to Do After a Data Breach at a Small Business

Cybersecurity

Standards & Security Baseline

IT Environment Review

Get a clearer view of your IT environment.