Most business email compromises start with one stolen sign-in, and most accounts carry settings nobody has looked at in years. Choose Microsoft 365 or Google Workspace and this checklist walks through more than forty checks across sign-in, devices, email, sharing, threat protection, data protection and licensing. For every one it tells you where to look in your own admin console, why it matters, and the first step to fix it. You finish with a prioritized list: what to fix this week, what to plan this quarter, and what to tidy up.
This check is free, and there is nothing to sign in to. It does not connect to your Microsoft or Google account. You just answer questions about what you see in your own settings. The quick check is ten questions and only takes a few minutes. At the end you get a short list, in order, of what to fix first. You can print it or save it, and hand it to whoever looks after your computers.
Your answers stay in your web browser on this device unless you ask us to follow up and choose to share them. We only get your email address if you ask for the printable report or ask us to contact you. We use it to follow up about your results, and we send tips only if you tick the optional box. It goes into our customer records so we can reply to you; this page does not keep a copy.
A checklist that rewards guessing is worse than none. This one treats what you do not know as something to find out, not as a pass.
Tell us your Microsoft 365 plan or Google Workspace edition first. Items that need a higher plan are shown, marked as not counted, and kept out of your score, so you see what an upgrade would let you check.
Questions you cannot answer are listed separately for you to find out. A score band appears only once you have answered at least 60% of the questions that apply to you.
Gaps that let someone in with only a password come first. Then controls that need testing before they are switched on. Then housekeeping. Print it or save it as a PDF and it becomes your plan.
No. It does not sign in to anything, scan anything or read your settings. You answer from what you see in your own admin console. Your answers are scored in your browser and saved in this browser on your device so you can resume, and they are not sent to us unless you choose to share them; a Clear button removes them. If you open the download form or the “contact me” form, the page loads Cloudflare Turnstile (challenges.cloudflare.com) to block bots. When you submit either one, we receive your name, email, optional phone and company, any message you choose to type, which platform you checked, your score band, counts of gaps, the address of this page (without any query or hash) and your consent choices. We receive your individual answers only if you ask us to follow up and tick the optional box “Share my results so your team can better assist me.” It is unticked by default, and it appears only on the “contact me” form. If you tick it, your answers are saved as a private report that your team can open from the link in your request; it stops being available after 6 months. Unlocking the printable report never sends them.
You need to be able to look at the settings. Where your platform offers a read-only administrator role, use it: it lets you view the places this checklist points to without being able to change anything. Use the lowest role that lets you see the setting, or ask whoever manages your account to open the page with you.
Pick the one that holds most of your email and files, finish it, then use the link at the end to check the other. Each platform keeps its own answers on your device, so switching never mixes them up.
Your results on screen are free and complete. The printable report is a convenience we offer in exchange for a way to follow up if you would like help with the gaps. There is no obligation, and you can use the on-screen results without ever giving us an email.
No. It is a free self-assessment and preparation aid. A high score means fewer known gaps in what you checked, not that your environment has none. Settings and plans change often, so verify each item in your own account. It is not legal, insurance or compliance advice.
Yes. We can scope a read-only review of your Microsoft 365 or Google Workspace setup and walk you through what we find. Book a conversation if that would help.
We wrote them ourselves from each vendor’s public documentation, which is linked from every item. They are not a copy of any vendor’s or benchmark’s checklist.
In a 20-minute call we will walk your results, tell you which gaps are quick to close, and scope a read-only review of your setup.
