Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A useful cyber resilience assessment starts with a business question: which services must keep running, what do they depend on, and how will you respond if one of those dependencies fails or is compromised? Work through the checklist below to identify gaps in governance, protection, detection, response, recovery, and supplier management. Record evidence and assign an owner to every action. This is a practical management tool, not a certification or a guarantee that an organization is resilient.
What a cyber resilience assessment should tell you
A vulnerability scan or security checklist can reveal technical weaknesses, but operational resilience also depends on people, decisions, suppliers, and the ability to keep serving customers during disruption. An assessment should connect cybersecurity safeguards to the business services they protect: for example, how a payment service depends on staff, devices, identity systems, cloud applications, data, and outside providers.
The aim is to make four things clear: what matters most, where a disruption could interrupt it, which safeguards are in place and working, and who will close or accept each gap. A policy or provider dashboard is not proof by itself. Look for evidence such as a current asset list, a reviewed alert, a documented escalation, or a successful restoration test.
Use CISA’s CRR as a reference, not a certificate
The U.S. Cybersecurity and Infrastructure Security Agency describes its Cyber Resilience Review (CRR) as “an interview-based assessment to evaluate an organization’s operational resilience and cybersecurity practices.” The CRR covers ten domains and produces a maturity report mapped to recognized standards. Its organization-wide, discussion-based approach can help leaders think beyond isolated technical controls. See CISA’s Cyber Resilience Review for details.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This checklist is shorter and is not a substitute for the CRR. Nor does completing it establish that you meet a standard or legal requirement. CISA’s voluntary Cross-Sector Cybersecurity Performance Goals (CPGs) are another way to prioritize foundational practices, but they are not interchangeable with an organizational resilience assessment. CISA cautions that implementing a goal does not necessarily satisfy the entire NIST Cybersecurity Framework subcategory to which it is mapped. Review the CPG FAQ and the Cross-Sector Cybersecurity Performance Goals to understand their intended use.
How to run the assessment
Bring together the people who understand business operations as well as technology. Depending on the organization, that may include an owner or executive, IT or security staff, service leaders, communications, legal or compliance, and people responsible for continuity. Ask for evidence rather than relying only on recollection. If a small business does not have a dedicated security team, assign the work explicitly to an accountable person and involve outside advisers where needed.
- Choose the scope. Select the business services to assess, including the systems, data, staff, facilities, and suppliers they rely on. Start with services whose interruption would have the greatest operational consequence.
- Set impact and recovery priorities. For each service, decide how long the business can tolerate an interruption, what data loss it can tolerate, and who can set restoration order during an incident. These are business decisions; do not assume a technology team can make them without service owners.
- Work through the domains below. For each question, note the current state, evidence, weakness, and plausible business consequence. Mark an item incomplete when no one can demonstrate it.
- Assign actions. Give every gap an accountable owner, due date, dependencies or budget needs, and a way to verify completion. Separate urgent risk-reduction work from longer-term improvements.
- Reassess after change or testing. Revisit the assessment when a critical system, supplier, business service, or threat context changes, and after an incident or exercise exposes a weakness.
Business resilience checklist
1. Governance, services, and scope
- Who is accountable for cyber risk, and who can approve urgent decisions if the primary decision-maker is unavailable?
- Which services must continue, and what is the acceptable interruption for each? Identify who owns each service and who can decide its recovery priority.
- For each priority service, identify supporting systems, important data, facilities, staff roles, cloud services, and external suppliers. Check whether the inventory reflects actual dependencies rather than only the systems owned by IT.
- Are cybersecurity responsibilities and relevant policies communicated to employees and partners who need to follow them?
- Have responsible legal or compliance staff identified applicable contractual, privacy, regulatory, or sector obligations?
Legal duties and reporting deadlines vary with location, industry, data, contracts, and regulators. A general checklist cannot determine what applies to a particular business; have qualified local legal or compliance staff confirm those obligations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Identity, devices, and protection
- Do staff use strong, unique passwords, with a password manager where appropriate? Are shared accounts avoided or controlled and attributable to an individual?
- Is multifactor authentication (MFA) enabled for business email, remote access, administrator accounts, and important cloud services?
- For high-impact accounts, can you use phishing-resistant MFA? Verify that the service supports the method and that it works with your users’ devices before choosing an authenticator. A FIDO2 security key is one possible physical implementation, not a specific CISA endorsement.
- Do you maintain an inventory of operating systems, applications, and network devices, and apply updates in a timely way?
- Are administrator privileges limited to people and tasks that need them? Can ordinary work be done without using an administrator account?
- Is sensitive business data encrypted where appropriate, and is access limited to people and systems with a business need?
CISA’s small and medium-sized business resources organize foundational advice around issues such as phishing, passwords, MFA, and software updates. Use these as a starting baseline, not as proof that every risk has been assessed. CISA also provides small-business guidance on phishing-resistant MFA through that resource page.
3. Detection, logs, and escalation
- What events are logged on endpoints, servers, network equipment, business applications, and cloud services? Is the scope based on what responders may need to investigate?
- Can responders access relevant logs during an incident? Are logs protected against unauthorized access or deletion and retained according to policy and applicable obligations?
- Who reviews alerts, including unusual login patterns and unexpected privilege changes? How does an alert reach someone who can act, including outside normal business hours?
- Are incident contacts, escalation paths, and response responsibilities documented and accessible to the people who need them?
Logging is useful only when the right events are available, someone reviews alerts, and responders can use the records. CISA recommends deciding what to log, enabling logs across relevant systems, reviewing alerts, protecting access, and setting retention in line with policy and compliance needs. Its guidance, Use Logging on Business Systems, also points small businesses to its no-cost Logging Made Easy resource.
4. Incident response and decision-making
- How does an employee report a suspected incident, and what is the route for reporting outside business hours?
- Who assesses severity, directs technical containment, and decides whether to take a system or service offline?
- Who communicates with employees, customers, suppliers, insurers, counsel, regulators, and law enforcement when appropriate? Are backup decision-makers named?
- Do response procedures address preserving evidence and recording important decisions?
- Has leadership taken part in a tabletop exercise? Were actions, owners, and follow-up dates recorded?
Incident response is an organization-wide function, not just a security or IT task. CISA’s corporate-leader guidance says: “Cyber incident response plans should include not only your security and IT teams, but also senior business leadership and Board members.” It recommends a tabletop exercise so leaders can discuss their roles and decisions before a real incident. An exercise can expose gaps; it does not guarantee readiness. See CISA’s guidance for corporate leaders and CEOs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Continuity, backups, and recovery
- Which services and systems should be restored first, and who has authority to set that order?
- Are backups frequent enough for the business’s tolerance for data loss? Are copies separated from the accounts or environment most likely to be compromised?
- Can the organization restore clean data and verify its integrity before putting it back into use?
- Have restoration and continuity procedures been tested against realistic disruption scenarios, including loss of a key system or supplier?
- Can staff operate manually or use an alternate process while a critical system is unavailable? Do they know how to use it?
A backup job reporting success does not prove that the business can restore usable data. Test restoration, record what was restored and how long it took, and check the integrity of the result. CISA’s #StopRansomware Guide recommends backing up data often and describes offline and cloud-to-cloud approaches. Choose an approach that accounts for access separation, business recovery needs, and the possibility that credentials or connected systems are compromised.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems6. Supplier and cloud risk
- Which suppliers can access business data, administer systems, or support a critical operation? Include cloud applications used for collaboration, customer management, or payment processing.
- Were security posture and recovery practices considered before a supplier was selected and at renewal?
- Do contracts allocate responsibilities for security, access control, incident notification, and cooperation during an incident?
- Do you know how to contact each critical supplier during an incident, what information it will provide, and how the business can continue if its service is unavailable?
- Can the supplier restore full functionality after a major incident and verify that restored data is intact?
Supplier risk is part of your operational risk even when the supplier runs the technology. CISA’s vendor assessment fact sheet and SMB vendor supply-chain risk management template provide practical questions and a template with yes, no, and partial response options. Use the answers to identify follow-up questions and contractual or continuity gaps, not as a guarantee that a supplier is safe.
Record findings so they lead to action
For every gap, write down the affected service or asset, the plausible business impact, the evidence reviewed, the action required, the accountable owner, the target date, dependencies or budget, and how completion will be verified. A useful finding is specific enough that another person can tell whether it has been fixed. For example, “backup recovery is unproven” should lead to a named owner and a scheduled restore test with a defined integrity check—not simply a request to “improve backups.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prioritize work by the services it protects and the consequence of failure. A weakness affecting a critical customer-facing service may deserve attention before a lower-impact issue, even if the latter is easier to close. Consider both the chance of disruption and its operational effect, but do not invent a numerical risk score unless your organization has a defined and consistently applied method. Record decisions to accept or defer risk, who approved them, and when they will be reviewed.
After an exercise, incident, or restore test, update the finding with what actually happened. A procedure that looks complete on paper but fails when staff try to use it is still a gap. Reassessment is especially important after material changes to business operations, technology, suppliers, or threats.
Choosing an assessment approach
Different tools answer different questions. A technical check can be useful for finding weaknesses in systems, while an organization-wide resilience review considers decision-making, continuity, and operational practices. Compare approaches by their scope, staff effort, supplier coverage, framework mapping, and whether they produce practical prioritized actions. CISA’s published CRR description characterizes it as interview-based and organization-wide; its CPGs are voluntary prioritized practices. The source pages cited below do not state a standard time commitment or cost for these approaches.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
| Approach | What it is suited to | What to check before using it |
|---|---|---|
| Internal checklist such as this one | Surfacing business dependencies, unanswered questions, evidence gaps, and owners for follow-up. | It is not a certification, formal maturity report, or complete legal and technical assessment. |
| CISA Cyber Resilience Review | An interview-based assessment of organizational operational resilience and cybersecurity practices across ten domains, producing a maturity report mapped to recognized standards. Source: CISA CRR. | Confirm the current availability, participation requirements, and process directly with CISA. The linked description does not state a standard time commitment or cost. |
| CISA Cross-Sector Cybersecurity Performance Goals | Voluntary prioritized practices that can help organizations focus on foundational cybersecurity improvements. Sources: CISA CPGs and the CPG FAQ. | Use them to prioritize, not as a substitute for assessing business continuity or supplier dependencies. A goal does not necessarily fulfill its mapped NIST CSF subcategory. |
For recovery options, compare the time needed to restore a service, acceptable data loss, separation from compromised credentials or systems, integrity checks, and evidence from restore tests. The best fit depends on the business service and its impact requirements; the presence of a backup in a provider dashboard is not evidence that recovery has been proven.
Limits and local requirements
CISA is a U.S. federal agency, so its guidance is a useful reference but does not determine obligations for every jurisdiction or industry. This checklist cannot establish notification deadlines, insurance coverage, contractual duties, or sector-specific control requirements for an individual organization. Confirm those matters against the rules, contracts, and regulators that actually apply to your business.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
