How do you know if your business is protected from a cyberattack?

Most business owners have never been given a plain-language definition of what protection actually requires. Their IT provider says things are handled. Their cyber insurance renewal asks about controls they've never heard of. Nobody has laid out what "protected" looks like in terms they can verify themselves.

Here's the honest answer: you can know. It's a checklist, not a feeling. A business is protected when it can answer yes, with proof, to each of the following, not a guess.

1. Multi-factor authentication is on everywhere it matters. Email, remote access, financial systems, admin accounts. Not just the ones someone remembered to configure.

2. Backups exist, and someone has actually tested restoring from them. An untested backup is an assumption, not a control.

3. Someone is watching for threats after hours. Not just during business hours. Attacks don't wait for a provider's shift to start.

4. There's a written, specific plan for the first 24 hours of an incident. Named steps and named people, not a general statement that "we'll handle it."

5. Old accounts and unused access get removed on a schedule. Every former employee or vendor with lingering access is an unlocked door.

6. Someone can show, in writing, what the current risk actually is. Not a general sales pitch about threats. The business's actual environment and actual gaps, in a document that can be read.

If any of these is a "probably" instead of a "yes, here's proof," that's the gap. Not a reason to panic. A reason to get a real answer.